14:31:33 RRSAgent has joined #vcwg 14:31:38 logging to https://www.w3.org/2026/05/20-vcwg-irc 14:31:38 RRSAgent, make logs Public 14:31:39 please title this meeting ("meeting: ..."), ivan 14:32:02 Meeting: Verifiable Credentials Working Group Telco 14:32:02 Agenda: https://www.w3.org/events/meetings/d811d954-dd65-4cce-844a-53dfd95e75c7/20260520T110000/ 14:32:02 chair: brentz 14:32:02 ivan has changed the topic to: Meeting Agenda 2026-05-20: https://www.w3.org/events/meetings/d811d954-dd65-4cce-844a-53dfd95e75c7/20260520T110000/ 14:32:12 regrets+ Phila 14:52:44 brent has joined #vcwg 15:00:40 JoeAndrieu has joined #vcwg 15:01:01 present+ 15:01:07 present+ 15:01:12 present+ brent, jennie 15:01:33 present+ wesley 15:01:54 present+ elaine 15:02:19 present+ nathan 15:02:28 present hsano 15:02:31 present+ 15:02:34 JennieM has joined #vcwg 15:02:37 wes-smith has joined #vcwg 15:02:37 pdl-asuj has joined #vcwg 15:02:41 present+ 15:02:42 present+ 15:02:45 hsano has joined #vcwg 15:02:45 present+ 15:02:48 present+ 15:02:53 s/present hsano/present+ hsano/ 15:02:54 present+ 15:03:22 scribe+ 15:03:48 present+ patrick 15:03:51 kezike has joined #vcwg 15:04:01 present+ 15:04:04 Brent: welcome, everyone on meeting needs to be member of W3C and working group or invited expert 15:04:12 present+ bigbluehat 15:04:14 ... any introductions? 15:04:34 present+ kevin 15:04:40 Topic: F2F Meeting 15:04:57 Brent: couple weeks away, meeting in Brussels, number of people both onsite and remote 15:05:01 https://docs.google.com/spreadsheets/d/1h-0OXOR5NsY-OlC0i26mCDK45B15j2BfkL8f2CIY30E/edit?gid=0#gid=0 15:05:14 ... agenda drafted and possible that things may still shift, content where we want to be 15:05:23 wes-smith has joined #vcwg 15:05:31 ...most of agenda given to task forces, each will have at least one 75 minute slot 15:06:05 ... expectation and hope is that Task Force leads will create brief intro on what Task Force is working on, rest of the time spent as they see fit - issue processing and raising PRs, discussing larger issues 15:06:12 ...however it wishes to spend time 15:06:50 ...please review what slots your Task Force has been assigned, limited ability to move things around, tried to be aware of remote participant needs but don't know all things and may not be able to accommodate all, but will do our best 15:07:06 present+ manu 15:07:06 present+ 15:07:09 ...questions from Task Force leads or comments on agenda? 15:07:19 q+ 15:07:26 ack JoeAndrieu 15:07:36 Joe: did we manage to close loop with when Simone could do threat modeling? 15:07:49 q+ 15:07:58 Brent: yes, Tuesday immediately following lunch - will make sure he knows time and has links 15:08:08 ... two 75 minute slots - first with Simone, second with the group 15:08:28 Joe: do we know what topically we want to spend time on? Most mature Threat Model or most immature? 15:08:46 Wip has joined #vcwg 15:08:50 present+ 15:09:09 Brent: Simone has exercise he uses with Working Groups, but whether we start with something mature or immature, we'll take feedback. Open to group on how best to proceed 15:09:11 ack kezike 15:09:34 kezike: what do you recommend for Task Force leaders who are remote for the day? 15:09:47 q+ to note Agenda looks good. 15:10:05 ack manu 15:10:05 manu, you wanted to note Agenda looks good. 15:10:07 Brent: if you can't attend when you are scheduled to lead, we may be able to swap with someone in person. Either leading remotely or coordinating with someone there is good 15:10:22 manu: agenda looks good to me, covers broad swath appropriately, thank you to chairs for putting it together 15:10:37 ...threat modeling, would like us to know what we are doing before we show up as it may require a lot of prep 15:10:40 dmitriz has joined #vcwg 15:10:40 manu has joined #vcwg 15:10:40 shigeya has joined #vcwg 15:10:40 dlehn has joined #vcwg 15:10:40 cel has joined #vcwg 15:10:40 jyasskin has joined #vcwg 15:10:40 dlongley has joined #vcwg 15:10:45 ...happy for us to take most far along model 15:11:21 q+ 15:11:26 ...let's take the most far along one and show people how it works - which one is that? other option is that we have a lot of people together, could we use time to work on least done one? two minds - Joe, suggestions? 15:11:26 ack JoeAndrieu 15:11:47 Joe: interested in helping one least far along bootstrap. Not fully certain which one is most far along 15:11:55 q+ 15:12:10 ...like bootstrap, give them the boost up and all groups would learn 15:12:10 ack manu 15:12:25 manu: I don't know if there are any threat models that are really struggling because we just started 15:12:36 q+ 15:13:06 dmitriz has joined #vcwg 15:13:06 manu has joined #vcwg 15:13:06 shigeya has joined #vcwg 15:13:06 dlehn has joined #vcwg 15:13:06 cel has joined #vcwg 15:13:06 jyasskin has joined #vcwg 15:13:06 dlongley has joined #vcwg 15:13:39 ...VCOM feels like good use of time - core issuer holder ecosystem. feels like something everyone would be able to participate in, something we all need to do, benefits other threat model. My vote of what we would focus on. Not super worthwhile to write barcode threat model, pretty niche, number of people who care about core threat model for VC 15:13:39 Data Model would be much higher 15:13:39 KevinDean has joined #vcwg 15:13:40 ack ivan 15:13:44 present+ 15:14:01 Ivan: very different problem, no idea how threat model would look for vocabulary work. 15:14:03 q+ to say there should not be threat model work for vocabularies :) 15:14:30 Joe: great question, think answer is that there probably shouldn't be one, similar question for registries 15:14:43 ....process isn't up to date with answering that, don't know if it makes sense to have one 15:14:55 Ivan: personally agree, but not sure what others would say 15:15:03 ack manu 15:15:03 manu, you wanted to say there should not be threat model work for vocabularies :) 15:15:32 s/VCOM/VCALM 15:15:34 Manu: agree with Ivan and Joe, don't think there should be threat models for vocabularies. Used by other systems, we could spend an eternity on just focusing on threat models and need to find right balance 15:16:01 Brent: remaining questions and concerns, please reach out to chairs 15:16:02 Topic: VC and AI 15:16:08 https://github.com/w3c/webai-roadmap/issues/38 15:16:28 q+ 15:16:36 Brent: asked in an Issue by Dom - team is seeking input on impact of AI on working groups 15:16:42 q+ patrick 15:16:55 ...not asking how we are using AI in meetings or specs, but how is AI impacting VCs and VCs impacting AI 15:17:13 ...20 minutes max 15:17:39 ack ivan 15:17:57 dmitriz has joined #vcwg 15:17:57 manu has joined #vcwg 15:17:57 shigeya has joined #vcwg 15:17:57 dlehn has joined #vcwg 15:17:57 cel has joined #vcwg 15:17:57 jyasskin has joined #vcwg 15:17:57 dlongley has joined #vcwg 15:18:00 Ivan: I took part in one of the discussions in another working group - kind of discussion - digital publication group 15:18:36 ...conceivable in a few years that there will be digital groups that can display content right away or read aloud, EPUB looking at what additional data and metadata should be added to make the feature really good 15:18:50 ....what are the features we might have to add or modify in our specs in the future as a result of AI 15:18:56 q+ to mention AI presenting VCs 15:19:01 ack patrick 15:19:06 manu_ has joined #vcwg 15:19:06 dmitriz has joined #vcwg 15:19:06 manu has joined #vcwg 15:19:06 shigeya has joined #vcwg 15:19:06 dlehn has joined #vcwg 15:19:06 cel has joined #vcwg 15:19:06 jyasskin has joined #vcwg 15:19:06 dlongley has joined #vcwg 15:19:12 q+ 15:20:00 Patrick: just going to share three quick points - reverse effect that VCs can be used to give authorization to AI, also think AI make implementation of - lot more easy to build these implementations, think AI can help understainding credentials and add purpose, and AI will probably drive features we want to add to the ecosystem, capabilities not 15:20:01 previously available 15:20:04 ack JoeAndrieu 15:20:04 JoeAndrieu, you wanted to mention AI presenting VCs 15:20:18 Joe: I think AI in any roles becomes interesting, should probably consider how that will change language 15:20:32 ....interesting wrinkle - is AI acting on its own or on behalf of legal person. 15:20:35 present+ pdl-asuj 15:20:42 ... how do we respond? 15:20:45 q+ pdl-asuj 15:20:50 ...not sure if there is consensus on how we would deal with it 15:20:50 ack manu 15:21:02 Manu: +1 to everything Patrick and Joe said 15:21:06 q+ 15:21:46 ...company vouch.id that presented, leveraged VCs and DIDs through whole protocol, example that they are building into protocols, deploying, using VCs for agent representation, 15:21:56 q+ to mention biometric confidence method as a specific response to personhood / agent questions 15:22:27 ...healthcare industry, seen very similar type thing where agent operating on behalf of individual has had something delegated to it that allows it to interact with patient records - also using W3C VCs and DIDs 15:23:21 ...explainability in AI, what reasoning path did AI go through to get to answer, today very probabilistic, seeing problems with that. AI conveying answers that make it seem like they went through a human-based thinking process, no formal mechanism that allows you to step through logic in more formal sense. 15:23:42 ack pdl-asuj 15:23:44 ...retail sector - agentic commerce - definitely seeing it here 15:24:09 this isn't new -- so just adding it in chat here, but of course VCs are also being used "defensively" or to help differentiate between AI (or things AI has produced) and humans/persons and what they have produced. 15:24:12 pdl-asuj: two responses - first, starting from perspective that there needs to be a connection between the DID whether it is being told to act or not, provenance needs to be retained and clear 15:24:36 ...LLMs are probabilistic by design, may get better, but unless disign changes, no deterministic path to decision making 15:25:03 ...notion of structured data formats VCs represent and algorithms used provide good anchor in keeping decision making reference back to some form of deterministic set of values 15:25:08 ack JoeAndrieu 15:25:08 JoeAndrieu, you wanted to mention biometric confidence method as a specific response to personhood / agent questions 15:25:18 Joe: wanted to highlight biometric template work in ??? task forc 15:25:30 ...if you are interacting with someone, can they prove who 15:25:36 s/???/confidence method/ 15:25:46 ...yes, we need something like biometrics to help us figure out if there is a real person involved 15:25:50 s/task forc/task force/ 15:26:03 q+ 15:26:06 Brent: thank you, good exploration so far. Most of what I've heard was positive, any other thoughts? 15:26:09 ack ivan 15:26:36 Ivan: my question would be in relation to all the various things you all said, are there or should there be additional extensions or changes in our model or specification somewhere to have positively those applications or counter problems 15:26:43 q+ to note that decentralized approach allows us to delegate to experts for that 15:26:45 ....would any of these influence how our specifications look? 15:26:48 ack manu 15:26:48 manu, you wanted to note that decentralized approach allows us to delegate to experts for that 15:27:24 Manu: great question, also note, we don't have to solve these problems for the world because we aren't the experts here, but Ivan, your point about would there be an extension or anchor that would help, we should look into that more 15:27:40 ... between DID and VCWG - delegation part that feels like something we could do that would be useful 15:28:01 ...but when you get into provable reasoning, nothing feels like we absolutely have to move on something right now 15:28:17 ...just got a decentralized extensibility model, hope people will do work outside of the group 15:28:22 ...mcpi and vouch 15:28:42 +1 to start documenting AI use cases as a first step 15:28:50 Brent: could have an AI related use case. Because VCs are building block and can be used, this would be a demonstration of how they could be used, now how they would be changed 15:28:59 +1 to AI use cases 15:28:59 q+ 15:29:06 ack manu 15:29:19 manu: real quick, apologies I was late, one thing I want to highlight with VC Data Model Core 15:29:42 Topic: https://github.com/w3c/vc-data-model/pull/1629 15:30:15 https://github.com/w3c/vc-data-model/issues/1628 15:30:15 ...PR to deprecate digest SRI - lots of +1s but also a push back on the issue 15:30:28 q+ 15:30:40 ...raised a number of things, don't want to merge right now because it feels like he is objecting, would be good for others in group to chime in 15:30:49 ...main concern with objections is that they are not technical in nature 15:31:04 ack brent 15:31:04 ...we've got to do something with the PR and issue, other opinions would be helpful in the thread 15:31:43 Brent: we do not have consensus to merge the PR (chair hat on) - implemented against ??? our changing the spec now or changing in the future is requiring implementations to change, which is a consideration we have to take seriously 15:31:48 bigbluehat has joined #vcwg 15:31:50 ...please engage on the issue 15:32:10 s/???/DigestSRI/ 15:32:23 ...important discussion group needs to have 15:32:25 Topic: Controlled Identifiers Maintenance 15:32:39 https://github.com/w3c/cid/issues 15:32:47 q+ 15:32:59 Brent: we have a number of open issues in Controlled Identifiers Specification, need to make sure they are triaged appropriately and have a plan to address them because we are chartered to maintain this spec 15:33:00 ack manu 15:33:22 Manu: there are a couple of comments. I made a pass over all issues to classify on changes, if ready for PR, lots that are not ready for PR 15:34:15 subtopic: https://github.com/w3c/cid/pull/168 15:34:02 ...one that is ready that Pierre-Antoine opened trying to qualify what the primary identifier is, one where I would appreciate more reviews on PR before merging. Don't think it harms anything, would also address one or two issues there 15:34:35 Manu: this PR is about allowing for fragment identifier in DID Document ID 15:35:04 ...we are introducing this new term "primary identifier" and the primary identifier in a controlled identifier document, needs to be something without a fragment 15:35:16 ...url of document, document ID must not contain a fragment 15:35:24 ...primary identifier must be the same as the canonical 15:35:46 q+ to say it sounds backwards 15:35:46 ...don't put a fragment in document ID, want to make sure other people think algorithms make sense 15:36:00 ... think it was confusing in previous working group 15:36:03 ack JoeAndrieu 15:36:03 JoeAndrieu, you wanted to say it sounds backwards 15:36:03 present+ 15:36:16 +1 to Joe 15:36:16 q+ 15:36:19 JoeAndrieu: manu, seems like what you said is opposite of this PR 15:36:29 ...okay to have fragment 15:36:32 ack ivan 15:36:37 Manu: think you are right, that would be bad 15:37:23 Ivan: so, I can fully understand where he is coming from, whether we like it or not, using fragment ID has been around and used for last 25 years, very often can even see formal ID of TBL 15:37:57 ...presume request came from solid working group (name today?) looking at CID as a tool for themselves, use case community that would like to use fragments. Whether we answer it or not is a different case 15:38:19 q+ to say it feels off 15:38:35 q+ 15:38:38 Brent: with the realization we were looking at this backwards, what are comments? We have the Issue, believe Issue links to conversation, I'm not super familiar with conversation in LWS 15:38:38 q+ 15:38:48 ack JoeAndrieu 15:38:48 JoeAndrieu, you wanted to say it feels off 15:39:03 +1 to Joe ... i think this just needs careful consideration ... and comparison against what the DID spec does for compatibility, etc. 15:39:06 JoeAndrieu: I think this feels a bit off, part of hesitation is simply not having had time to understand if there is something deeply wrong with why it feels off 15:39:29 ...confusing if there there a fragment that is not #me, don't know how that even works in a JSON-LD framework 15:39:40 q+ 15:39:47 ack manu 15:39:50 ...naive solution would be to take ID and append secondary fragment, now we have two fragments and that fees wrong 15:40:06 Manu: apologies, totally misrepresented PR, read through it twice 15:40:19 ...http range 14 conversation that never dies, reading through with that understanding 15:40:32 ...do admit that it is going to be hard to justify not allowing a fragment identifier in the CID document 15:40:44 ...Joe, agree it feels off, always fall on other side of range 14 conversation 15:40:52 ...type of resource tells you what it is point toward 15:41:08 ...but group of people that will never agree, fear is that we get pulled into a range 14 discussion 15:41:19 ...don' think this breaks anything, but need to be very very careful with this PR 15:41:31 ...now three different terms we use in spec to talk about URLs for document itself 15:41:44 q- 15:41:46 ...base identifier, primary identifier, canonical URL, and each of those means something a bit different 15:41:49 needs a little security analysis for things like how comparing controllers when resolving verification methods changes, etc. 15:42:20 ...just a warning it is range 14 territory, keep in mind while reviewing. But to agree with Ivan, that community agrees that there should be hash identifiers on these IDs 15:42:35 ...don't know if there is any big problem adding this feature, but ramifications are pretty broad 15:42:38 s/range 14/HTTPRange 14/ 15:42:39 ack bigbluehat 15:42:56 q+ to note it's not as straightforward as it seems. 15:43:03 Benjamin: I don't think I'd be quite as ?? range 14, think it is clarifying something that isn't clarified now 15:43:14 s/??/HTTP/ 15:43:19 ...its permitted now, can put fragment identifiers in all of these URLs 15:43:25 Joe: not permitted now 15:43:39 Benjamin: in CID spec, fragment identifier can appear? 15:43:46 Manu: no, specifically banned that 15:44:01 Manu: long discussion, fragment IDs not allowed 15:44:13 s/Benjamin/bigbluehat 15:44:19 ...think that as always range 14 issues seem simple, but not 15:44:31 ...allows a different level of attacks, made us not feel great about security attack surface 15:44:40 q+ 15:45:00 ack manu 15:45:00 manu, you wanted to note it's not as straightforward as it seems. 15:45:01 ...if we are going to allow people to use fragment idenfiers, how does it change ??? could it be used as an attack vector to use key or object mix-ups, all these things come up when we allow this 15:45:10 +1 it might end up being ok, but requires more analysis. 15:45:13 ...may be okay, but need to look at Data Integrity spec and se how it it is used 15:45:31 ...never really used CID spec directly, they would be the first ones really using the spec 15:45:34 ack bigbluehat 15:46:05 q+ 15:46:08 Bigbluehat: I think one of the things triggering the range 14 bits is the section using hash me, but that could be any identifiable thing with a fragment, is a JSON-LD document 15:46:16 q+ it is not always a JSON-LD document. 15:46:21 q+ to note it is not always a JSON-LD document. 15:46:24 ... so I think it is maybe okay, but we should dig into whether it is actually before we do the wrong thing 15:46:25 ack manu 15:46:25 manu, you wanted to note it is not always a JSON-LD document. 15:46:38 q+ to ask where in the spec is the fragment outlawed 15:46:49 +1, it is also used that way in my ownn foaf file 15:46:57 Manu: just to highlight why this seems simple - not always JSON-LD document, people who worked on this spec wanted to be able to use it without JSON-LD, so algorithms are not always straightforward 15:47:03 ack JoeAndrieu 15:47:03 JoeAndrieu, you wanted to ask where in the spec is the fragment outlawed 15:47:06 q- 15:47:07 s/ownn/own/ 15:47:26 Brent: that is PR 168, let's look at our Issues now 15:47:47 ...did someone just go through and put a bunch of class II and Class IV from these? 15:47:50 Manu: yes 15:48:06 subtopic: https://github.com/w3c/cid/issues/170 15:48:30 q+ to note it's class 2 15:49:00 Joe: not sure which class it should be 15:49:06 ack manu 15:49:06 manu, you wanted to note it's class 2 15:49:34 Manu: I vaguely remember using CID and it working, totally agree with Joe that this should work, maybe it is CID 1.0, ways to do aliases, need someone who can work with XREF to work with it 15:49:50 Joe: part of confusion, I meant to refer to term controlled indentifier, not specification 15:49:59 Ivan: double brackets is for reference to documents 15:50:00 q+ 15:50:16 Ivan: think you are looking for a different notation 15:50:28 ack manu 15:50:32 JoeAndrieu: I'll check, may not be an issue 15:50:55 xref: ["CID"] 15:51:01 Manu: this does work Joe, just checked in DID spec - search for document and it is cross-referenced 15:51:04 [=controlled identifier document=] 15:51:25 JoeAndreiu: that worked, but that is not CID 15:51:34 Manu: you want to type in CID, where do you want it to link? 15:51:41 JoeAndrieu: the term 15:51:53 Manu: we need to export the shortened version 15:52:04 JoeAndrieu: I think we're on the same page 15:52:10 Brent: Agreed, Class II change 15:52:16 subtopic: https://github.com/w3c/cid/issues/169 15:52:25 q+ 15:52:27 Brent: look at 169 to ensure Class IV is appropriate 15:52:45 ack manu 15:52:46 ...opened three weeks ago, would require an addition to the IANA registration for CID 15:53:15 Manu: I believe so, but forget what we registered. Suggestion is that we don't do this because multiple different profiles lead to non-interoperable implementations 15:53:41 ...want to be specific about profiles, think we need the activity pub use case 15:54:10 ...better thing would be for community to argue for changes into CID spec, need more info from them. Don't think profile leads to good interop 15:54:36 Patrick: just curious about idea that profiles hurt interop 15:55:06 q+ 15:55:11 ...think profile can give clear pictures of what someone can align to, profiles being prescriptive about specification you want to implement. Don't see why they hurt, don't think they are ultimate solution 15:55:59 ...I feel sometimes, some specs more than others there is a lot of optionality, optionality is good, but it can also spend a lot of time. Profile can give a path to a more direct implementation, not sure I totally agree that profiles are bad based on my limited experience 15:56:00 ack manu 15:56:44 Manu: profiles are somewhat okay when what you explained ends up happening, but that is not always what happens. With CID spec, you can choose to punt JSON-LD to curb and add lots of features and make that your profile, then you have features that are a superset - you can just add whatever you want to 15:57:14 ...typically that is not super great if it is not clear, yes you can do that, but inevitably it will make it so that your community is the only one that can implement 15:57:44 ...adding profile allows you to do whatever you want, and sometimes people do things that completely break interop without any discussion with broader community, which is where interop failure comes in 15:58:01 q+ to note very little time to work on CID 15:58:09 Patrick: agree 100%, do not think profiles should extend capabilities, see them as extension of selected 15:58:40 ... for me, this doesn't add anything, but agree if profiles want to use on own features that expand spec, can see why this would be dangerous path 15:58:42 ack manu 15:58:42 manu, you wanted to note very little time to work on CID 15:58:46 Manu: +1 to that 15:59:15 ... complete side note on spec, I'm one of the editors, have very little time to work on spec and it is lower priority, if there are other editors who would like to help out that would be great 15:59:29 Brent: 17 open issues in CID spec, 10 labeled Class II so we can address them. 15:59:36 ...work to be done on this spec, need people to jump in 15:59:51 rrsagent, draft minutes 15:59:52 I have made the request to generate https://www.w3.org/2026/05/20-vcwg-minutes.html ivan 16:00:04 ...look forward to meeting next week, then in Brusels 16:00:09 rrsagent, bye 16:00:09 I see no action items