Having led the authoring teams on several Trust Framework and related projectS over the years, it is interesting to look back over the history of the field and consider what lessons and threads can fruitfully be brought forward to the next generation of Trust Frameworks evolving today.
Below, provided for background, are links to the CARAT Guidelines, the Mutlistate Emall, the Real ID Federation, the eAuthentication Federation, the E-Authentication Partnership and risk-based approach of ActuariNet. Unfortunately, many of the Trust Frameworks I have done are not legally sharable due to their classification of confidentiality. However, it is possible to discuss broad themes and based on the materials that are capable of being shared publicly there are many relevant precedents and lessons to be gleaned.
The CARAT Guidelines were, and remain, a seminal work on the topic of Trust Framework design, anatomy and implementation. While the scope was narrowly constrained to the technology of Public Key Infrastructures, the underlying principles regarding legal relationships, rights and obligations, governance and business models remain relevant and instructive.
The first version of the Multistate Emall took longest to draft, involving several state government and large private sector vendor suppliers of office, computer and other supplies, among other parties.
The second version of the Operating Rules contained mainly technical modifications.
The third and final version of the Operating Rules for the Multistate Emall applied a different approach, emphasizing parsimony and simplicity.
Download Trust Framework_010605_final
The Electronic Authentication Partnership Trust Framework subsequently became the Liberty Alliance and now the Kantara offerings.
Download E-Authentication Federation Legal Suite
The E-Authentication Federation "Legal Suite" featured not only the overarching Operating Rules, but also the specified legal "Opt-In" agreements to be executed by the Relying Parties, the Credential Service Providers and the key terms to be agreed by the end-users who were the people to use and be identified by the federation.
Download ID_federation-prior-version
The above documents were earlier versions of the E-Authentication Federation Legal Suite, and were re-published on the web by the E-Commerce Coordinating Council in it's White Paper on Identity Federations.
The Real ID federation governance, operating rules and architectural document was commissioned by the DHS Privacy Office and included several state governments and other stakeholders who developed a potential method of complying with the Real ID statute while attempting to ensure privacy and civil liberties through self-imposed policy and contractual requirements contained in the legal suite, to be agreed by the participants. (This document is not yet linked, pending confirmation of it's sharability status).
ActuariNet was a research initiative of the MIT E-Commerce Architecture Program, applying a risk-based approach to the design and architecture of eBusiness and eGovernment systems.