Draft proposal · No agreement in place · Nothing has been awarded

Review proposal

Utah Life · A higher education proposal

Your record.
Yours to carry.

A proposed open network where students hold their identity, credentials, agreements, and proof-and universities remain the authority on what they issue.

Starting with 111,794 students at three Utah universities.

Explore the idea Funding details
The proposal

A network built around the
student

Utah has a digital identity law and no evidence yet that it works at university scale. Two linked applications propose to build the reference implementation, test where it succeeds and fails, and publish the results and conformance suite either way.

Each university holds its own keys. The person holds their own record. No company sits in the middle.

What you get

Eight things you can actually do

The practical value comes first. The technical standard exists to make these experiences possible.

01

Identity

Prove one thing without showing everything

Share only the fact someone needs-such as enrolled: yes-while the rest stays with you.

02

Payments

Pay, get paid, and never pay a fee

Tuition, lunch, parking, or a campus paycheck without a student surcharge or pass-through fee.

03

Endorsements

Keep the proof when someone vouches for you

Hold signed, verifiable recommendations that remain useful when people or institutions change.

04

Reputation

Show what you have actually done

Carry projects, service, and demonstrated skills without a hidden score, rank, or leaderboard.

05

Agreements

Sign it and hold your own copy

Keep proof of who signed and exactly what they signed-without asking an office for a copy.

06

Credentials

Prove what you earned, once, forever

Let a school or employer verify degrees, certificates, and competencies in seconds.

07

Community

Connect without becoming the product

Use campus groups and messaging on open protocols run by participating institutions.

08

Your own intelligence

An assistant that works from what you hold

Grant limited authority for one purpose, see what happened, and take that access back.

Why it matters

Who holds your
record changes
everything.

Today, a company or office usually holds your grades, money, signature, messages, and identity and lets you look at them. You are the subject of the file, not its owner.

This proposal tests another arrangement: disclose one fact at a time, choose who receives it and for how long, and walk away from any provider without losing what you earned.

The best artificial intelligence can remain available, but it becomes a tool you aim not a party you are exposed to.

The gap

A law with no evidence
it works

SB 275 says identity is inherent to the person rather than bestowed by the state, requires minimum-necessary and selective disclosure and offline presentation, and bars surveillance use. No U.S. jurisdiction has tested those principles at population scale - nobody has published what such a system costs per verification, whether selective disclosure actually reduces exposure, or how it handles a lost phone, poor connectivity, a screen reader, or a student without a smartphone.

Utah legislated a principle. This project finds out whether it survives contact with 111,794 people.

111,794

Students at the three participating universities (USHE, fall 2025)

216,116

Students in the whole Utah system - the three are a majority

29

Utah counties reachable through USU Extension

0

Tested reference implementations at population scale today

Keys

The lock can change.
The address never does.

Everything on this page rests on one small piece of machinery: the keys that prove a record is yours. Four questions every person actually asks - where keys come from, what happens when one is stolen, what happens when a phone is lost, and how an assistant can use any of this without learning who you are.

01 · Origin
Derived keys

One secret on your device quietly produces a separate key for every place you use it. Nobody can connect them.

02 · Change
Rotating keys

Retire a key and name its successor without changing who you are on the network.

03 · Recovery
Key restoration

A lost phone is an inconvenience not the loss of your degree, your money, or your history.

04 · Delegation
Your intelligence hires theirs

Your own directed intelligence uses a large model without ever handing it who you are.

One root, many keys
Your root secret
  • Never leaves the device
  • Never sent to a server
  • Never seen by your university
Identity key
DKX7...9MQ2

Shown to the registrar

Payments key
DA3M...PV8L

Shown to campus merchants

Agreements key
DQP9...T4XC

Shown to a counterparty

Community key
DZT4...BR6N

Shown to the comms server

Derivation runs one direction. A key can be produced from the root, but the root cannot be worked backward out of a key. Because each party is handed a different key, two of them comparing notes learn nothing: the registrar and the campus store hold values that look unrelated. This is what an automated system cannot follow. A platform, or a model, that sees your key at one place and your key at another has no mathematical way to know they belong to the same person. There is nothing to stitch. You do not memorize any of this and you never type a key.

Never changes, not once
Signing key DKX7...9MQ2
In Force
Next key, sealed EJ9K...W2FS

Each entry in your record does two jobs. It signs with the key in force at that moment, and it seals a fingerprint of the key that will come next. The successor is committed before it is ever used, so a thief who takes today's key still cannot name tomorrow's. Rotating is a normal event in the log, not a new account.

Try a signature from the retired key

A verifier replays this log from the beginning. It accepts a signature only if the key was in force at the sequence number where the signature was made.

Survives a lost device
The phone you lost DQp9...t4Xc key held here
Your new phone nothing on it yet
Witness nodes holding your log. Any 3 of the 5 is enough.
UVU node BUV1...7RK4
idle
UVU node BUV1...7RK4
idle
Weber State node BWB3...Q2LN
idle
State archive BST4...M6YD
idle
ClearFoundation node BCF5...V8HA
idle
agreement: waiting replayed: none

Not one of these nodes can read your record. They hold a signed log and confirm what order it happened in. No node can issue a key. Only your root can.

How it works
Never shown to any model
Your device
  • root secret,never leaves
  • your record, held here
  • your rules, set by you
Your directed intelligence
  • reads your record locallydecides what to ask, and how littleissues authority one grant at a time
The grant
  • Key: none yet
  • Purpose: compare two transfer paths
  • Discloses: credits earned, 64 credits
  • Not disclose: name, ID, grades
  • Expires: in 10 minutes
  • minutesrevocable: one tap
A large model

Public, or private and non public

  • Sees: a fresh identifier
  • Sees: the question, the 64 credits
  • Never: your root
  • Never: your other keys
  • Never: your history
  • Never: standing access
State: idle

This is the difference between directed digital intelligence and artificial intelligence in one picture. Yours runs on your device, reads your record locally, and decides how little to ask. Theirs is very good at language and reasoning, and it gets exactly one scoped grant, under a key that was made for this request and will never be used again. When the grant expires the model holds nothing it could use to find you, and the next request arrives under a different key it has never seen. Public model or private one, the boundary is the same. You direct yours. Theirs hires theirs.

01
A stolen key is not a stolen life

Rotation retires the old key in the same record that names the new one. The theft becomes a dated line in your history instead of the end of it.

02
Old signatures keep standing

The log says which key was in force when, so a transcript signed two years ago still verifies after four rotations. No re-issuance, no fees.

03
Nobody can do it for you

Your university can issue a credential and witness your log. It cannot rotate your keys or sign in your place - and neither can the company that built this.

04
The model never learns who you are

Every request rides a key made for that request and never used again. Two requests share nothing a model could use to connect them.

One open standard · Nobody owns it

Three universities. You in the middle.

UVU

Utah Valley University
www.uvu.university
Own keys

WSU

Weber State University
www.weber.university
Own keys

USU

Utah State University
www.usu.university
Own keys

Your keys. Your record.

The institutions are peers not branches of a platform. Each can revoke only what it issued, and none can read the others.

Infrastructure

Built in one place, controlled from three

Everything is engineered and hosted from the Canopy campus in Lindon - the reference node, the witnesses, the hosting, the engineering. The keys are not. The standard in the middle is public and belongs to nobody; the keys stay with each university. Take the base away and the standard still exists and the keys still work.

Control

Who controls what, stated plainly

Each university controls its own issuance

Its own keys in its own hardware, its own issuance policy, its own revocation registry. It can revoke what it issued and nothing else. No node can issue on another node's authority or read another node's records.

The person holds the credentials

In a wallet on their device. They choose what to present and to whom, one attribute at a time. Custodial recovery exists and is opt-in and separable - not a back door held by anyone by default.

The standard is shared and open

KERI and ACDC for keys and authentic chained data, W3C Verifiable Credentials for format, OpenID4VP for presentation. The conformance suite is published open source so the state can check any vendor's claim - including ours.

Nobody keeps an aggregate store

There is no central database of who holds what, and nobody can list who verified what. A wallet that is a view onto someone else's server is not a wallet.

SEDI · Utah Code 53H-8-211

How this follows Utah's statute

Utah's State-Endorsed Digital Identity statute, SB 275 as amended in February 2026, sets requirements. The LIFE Standard Reference Architecture maps each to a shipping component - this project is the first independent, instrumented test of whether that mapping holds at population scale.

Statutory requirement How this project meets it Where it is tested
Right to create and own a digital identity Root identity is created on the person's device and owned by them. No university, agency, or company creates it for them. Reference implementation, all three nodes
Right to control data and likeness The vault, credentials, and persona scopes are the person's. Institutions issue into them and cannot read across them. Control section; conformance suite
Right to selective disclosure Every credential supports partial attribute disclosure natively - a full document is never presented when one attribute answers the question. Minimization study, HERFP Objective 3
Right to persona separation Derived keys, one per relationship, enforced at the data layer. Two parties comparing notes learn nothing. Keys section; margin studies
Right to recovery and portability Key event log continuity with a 3-of-5 witness set, rotation without loss of identity history, exportable vault. Keys panels 02–03; HERFP Objective 4
Right to request and reuse data Data portability and import so a record moves between institutions and out of the network entirely. Portability study, HERFP Objective 5
Offline presentation; no surveillance use Verification is a local cryptographic check against a witness quorum. No verification log accumulates anywhere, so there is nothing to surveil. Architecture constraint; red team, Objective 7

The statute says identity is inherent to the person rather than conferred by government. The specification's first rule says the same: the member always owns the identity, credentials, data, personas, likeness, and relationships; the provider supplies infrastructure, not ownership. Specification: Digital World Engineering Specification v3, section 16, published at docs.digitalworld.earth. The conformance suite built against it is a funded deliverable released open source.

When

What ships now, what follows,
what waits

Now · Both awards, year one
  • Identity- prove one fact, not everything
  • Payments- no fee, no surcharge, ever
  • Endorsements- you keep the proof
  • Reputation- attestations, never a score
  • Agreements- signed, and you hold your copy
  • Credentials- verified in seconds
  • Community- on infrastructure your university runs
  • Your own intelligence- one scoped grant at a time

Every one is a real transaction with a real current cost - which is what makes the measurement meaningful.

Phase II · Years two and three
  • Transfer articulation - credit accepted at the next institution, proven once
  • Campus and association voting - eligibility separated from the secret ballot (public elections out of scope)
  • Housing - verified applicants and landlords, gated by fair-housing counsel
  • Transportation - transit, parking, verified carpool
  • Marketplace - verified peer marketplace with escrowed settlement
  • Campus permits - parking, event, lab and facility access as credentials
  • More universities - any USHE institution, from the published specification

Funded inside the awards where the application says so, gated by counsel where noted.

Later · Other issuers
  • Professional licenses - once state licensing boards become issuers
  • Professional certifications - industry and board, alongside academic ones
  • State permits - when a state agency, not a university, is the issuer
  • Employer and civic credentials - the wider Utah Life vision

Not in either application - listed so the roadmap is visible and the scope is honest.

Sequence

What happens in what order

1

UVU first, and to depth - largest student body in Utah and home of the principal investigator. Enrollment verification, then degrees, then competencies.

2

Utah State second, for the rural question - Extension offices in all 29 counties, sites chosen for bad connectivity rather than convenience.

3

Weber State third, deliberately last - a third team stands up a node from the published specification alone, with no hands-on help. If they cannot, the reference implementation is not reusable, and we would rather learn that inside the award.

4

Cross-node verification - a credential issued by one node, presented at another, verified with no call back to the issuer.

5

Publish - cost per verification, minimization actually achieved, and every failure mode found, released as a public dataset with a reproducibility package.

Applications

Two scopes. No double billing.

HERFP Track 1 Not submitted

Research translation · Secure computing

Credential issuance, verification, portability, a conformance suite, trust framework, and adversarial security research.

Request $4.85M
36 months
AI Moonshot Not submitted

Open horizon · Area 5

A pro-human AI agent bound to student-held credentials, with scoped delegation, a consent ledger, and measurement of human agency.

Request $1M
24 months

The proposal states that both applications include a cost crosswalk so no person, equipment item, or cost line is charged twice.
An additional $3.5 million in cost share is offered; its schedule is incomplete.

Current status

Facts, not promises

This page presents a proposal, not an operating university program. The published results would include costs, privacy outcomes, and every failure mode found.

Stage Notice of intent filed
Agreement status None. Nothing signed.
Awarded to date $0
University funds at risk $0
Lead institution Utah Valley University
Principal investigator George Rudolph, Ph.D.
State deadline October 15, 2026
Decisions expected Nov. 30 & Dec. 1, 2026