Age assurance service providers

What the clause says

A provider can stand between the person and the relying party, derive the attribute and disclose only the minimum. Where it verifies, it relies on a record issued by a party with authority over the attribute, and checks that the data was not misissued or altered.

What it supplies to a comparison

The intermediary role changes what the relying party can observe. A comparison must decide whether it is testing the provider's output or the relying party's decision, and must not mix the two.

Evidence to keep

• The data disclosed to the relying party, field by field.
• The provider's check on the issuer and on alteration.

What the evidence looks like

For 4.5, the first artefact is The data disclosed to the relying party, field by field.. The second is The provider's check on the issuer and on alteration.. If 4.5 has no first artefact, the practice is unproven at 4.5, and the report should record the absence rather than infer the practice from a policy.

Questions for the provider

1. What exactly does the relying party receive, and is it the minimum?
2. Who is accountable when the provider's check fails?

How it connects to the draft

Age assurance service providers belongs to 4 characterisation, and it gives the analysis one fixed point: The intermediary role changes what the relying party can observe. A comparison must decide whether it is testing the provider's output or the relying . A comparison that cannot place a result against 4.5 is measuring something the framework has not defined, and the report should say so.

In the register, 4.5 is read beside the unit that tests it, and where it sets an objective rather than a number, that unit turns the objective into a question and an evidence artefact.