Verified Person 2.0: Add details about assurance process

Per feedback from Adrian Field. We should include the details about assurance process. This input will be considered for version 2.0 of the Verified Person schema:

Feedback provided via slack on 14-Aug:

My point is that now the VC is for a VerifiedPerson, I would expect to get from the VC, two key things: who issued it (and agree the VC DM gives at least an org did for this - but may need other info e.g. other PKI certs in the did doc, VICAL URLs for mDLs etc.) And the other thing is ‘how was the verification done, against what governance framework?’

I don’t mean that we need to prescribe any particular governance framework, just that the schema should have a field/attribute(s) where this can be recorded/transmitted (as OIDC for IDA does).

e.g. OIDC has the following attributes: Trust Framework The governance rules under which the identity was verified.

- Assurance Level The assurance level based on the trust framework.
- Policy The policy that was followed in assessment of the assurance level.
- Procedure The specific procedure from the policy that was followed in order to ascertain the assurance level.
- Transaction Type The type of ID evidence that was used to prove the identity.
- Record Type For electronic_record . The type of record that was used to prove the identity.
- Record Source For electronic_record . The source of the record that was used to prove the identity.
- Document Type For document . The type of document used to perform identity verification.
- Check Method The method used to check the evidence.

e.g. a bank ID ‘Verified Person’ could return this:

- Trust Framework uk_diatf
- Assurance Level medium
- Policy gpg45
- Procedure m1c
- Transaction Type electronic_record
- Record Type bank_account
- Record Source Lloyd’s Bank
- Check Method auth

This enables KYC reuse, as the relying party can see how the verification was done, and to what LoA etc. The governance attributes can be blank (and without this the ‘Verified Person’ would be less trustworthy in my view) - but I think the fields should be in the schema. Otherwise the VC issuer is claiming that a person has been verified, but with no information as to how the verification has been done. Including governance info also helps DIF align to the Trust over IP model, where ‘data exchange protocols’ covers the schemas being defined, and info on the ‘credential frameworks’ governance side of the model can be included in the schema too.