A trust framework defines how organizations exchange identity information, how recipients may use it, and what guarantees the identity provider makes. In federated identity, it complements protocols such as Security Assertion Markup Language (SAML), OAuth, and OpenID Connect, which carry authentication status and attributes between an identity provider and a relying party. section 2.5.2
Trust frameworks establish different arrangements depending on the identity model:
- Enterprise federation commonly uses bespoke contracts between organizations. An employer can provide employee authentication to a benefits provider, with agreed attributes exchanged behind the scenes. section 2.5.2
- Public online federation often replaces a formal bilateral agreement with a standardized click-through license. A website may redirect authentication to Google and receive an access token containing claims. section 2.5.2
- Decentralized identity uses trust frameworks to help relying parties recognize credible issuers without negotiating an agreement with every issuer. section 2.5.3
University transcript
A university issues a transcript credential to a student, who presents it to an employer. An accrediting organization’s trust framework helps the employer determine that the university is genuine, even without a direct agreement between employer and university. section 2.5.3
The framework therefore connects identity, governance, privacy, and authorization. It determines which assertions or credentials a relying party can accept and under what assurances, while decentralized models distribute the choice of whom to trust across participants. section 2.5.2 section 2.5.3
