QILAHK™ / TRUSTMARK & REGISTRY
Trust Registry: Current State and Decision History
Keep a discoverable trust state connected to the history that explains it.
· QILAHK Journal
Two questions need two views
A relying party asks whether a trust state is current. An investigator asks how that state came to exist. A registry design should support both questions without losing the distinction between them.
In the QILAHK model, the Trust Registry™ is the discovery and verification layer for trust states and associated proof. Its usefulness depends on clear identity, scope, and decision references.
Identify the subject consistently
Use a stable subject identifier and record relevant aliases separately. Names can change, devices can be replaced, and product labels can cover several versions. A registry entry should make it difficult to confuse a replacement asset with the subject of an earlier decision.
Version-specific claims need version-specific references. If a record concerns a defined configuration or release, preserve that detail alongside the human-readable name.
Preserve changes as history
Updating a current status should retain the decision that justified the transition. Record the prior state, resulting state, effective time, authority, and reason. Link superseding decisions so readers can follow the sequence.
For example, a reassessment may replace an earlier determination after new evidence is reviewed. The original determination remains part of the historical explanation even when it no longer represents the current state.
Expose only what is needed
Discovery does not require publishing every supporting artifact. Public verification facts and restricted evidence can have different access requirements. Decide which fields a relying party needs and which details are available only to authorized reviewers.
A useful registry record answers who or what the subject is, which claim is represented, which authority decided, and whether the state is current. Its history answers how and why that state changed. Together, these views support informed reliance and accountable review.
Continue exploring the foundations in Cybersecurity Has Security Controls. What It Lacks Is a Trust Layer.
← Back to the Trust Authority Blog