Technical confidence is assurance that an identity or access decision is supported by technological evidence, verification, and enforceable controls. It helps establish whether an identity is valid, whether a party is authentic, and whether a policy has been applied correctly. It is essential for secure identity systems, but cannot by itself establish that a policy is fair, correct, or trustworthy. section 2.6.4 section 3.2
Technical confidence and human trust address different risks:
- Technical confidence relies on cryptography, software, authentication, and policies to make identity verification and enforcement objective, measurable, and scalable. section 2.6.4
- Trust relies on governance, oversight, and social norms to assess whether policies are fair, accountable, adaptable, and acceptable. section 2.6.4
- Strong technical controls can still be undermined by insider threats, weak policies, social engineering, or failures to recognize human expectations. section 2.6.4
Authentication and relationship integrity
Authentication preserves confidence that the entity that established an account is the entity currently using it. The relationship is two-way: users also need assurance that they are connecting to the real service. Transport Layer Security (TLS) uses certificates issued by trusted Certificate Authorities to link a server domain to a public key and establish a confidential channel. Misconfigured or expired certificates, man-in-the-middle attacks, and deceptive domains can still defeat the practical assurance signaled by a browser lock. section 3.2
Table 2.2 A comparison of technical confidence and trust
| Aspect |
Technical confidence |
Trust |
|---|---|---|
| Foundation |
Cryptography, software, authentication, policies |
Governance, oversight, social norms |
| Scope |
Ensures identity validity and policy enforcement |
Ensures policies are fair, accountable, and correct |
| Strengths |
Objective, measurable, scalable—identity verification and enforcement can be automated with high reliability. |
Flexible, adaptable, and responsive to human concerns—allows for policy exceptions, ethical oversight, and judgment |
| Weaknesses |
Can be circumvented by insider threats, weak policies, or social engineering |
Can be subjective, slow, and prone to human error |
Compare the foundations, scope, strengths, and weaknesses of technical confidence and trust when designing identity systems and authorization policies. section 2.6.4
