Identity Governance at Planetary Scale

The scale problem, stated without numbers

Persistent identifiers for documents are already a large undertaking. Identifiers for the constituents of ecosystems are larger by kind, not just by count. Documents are created by a relatively small number of publishers; fields, devices, lots, observations, and people come into being continuously, everywhere, under thousands of jurisdictions and institutions. Many of these referents are sensitive: people, culturally significant places, the locations of endangered species, commercially confidential supply relationships. And many will change hands, merge, split, or cease long before the institutions that registered them do.

Three pressures follow. The first is volume and distribution: issuance has to happen close to where referents are encountered, by many independent authorities, without coordinating through a single queue. The second is trust and abuse: the more valuable shared identity becomes, the more attractive it is to impersonate an authority, to flood a namespace, or to probe for the existence of protected records. The third is time: identifiers are promised for the lifetime of the registry, while organizations, servers, and software last far less. A design that handles one of these pressures by weakening another — for example, centralizing to improve consistency while concentrating a single point of control and failure — does not meet the brief.

Delegation is the first scaling mechanism

The RID's structure already answers the first pressure. A prefix names a registered issuance namespace; within it, issuers generate suffixes from eighty random bits and check uniqueness locally before finalizing (§3.3). A namespace authority may run several issuance services, coordinated through atomic insertion or "a verifiably disjoint delegated allocation scheme" (§3.4). That means issuance does not need a global lock. The authority for a regional network can issue identities for its farms and sensors without asking anyone else, so long as its prefix is registered, its delegation is verifiable, and its own registry guarantees uniqueness.

The diagram is a sketch of what delegation permits, not a deployment. The only global function is prefix allocation, which is rare and slow-moving by nature. Everything else — issuance, record-keeping, the authority's own delegations to sub-issuers — can be partitioned by namespace. The prefix and issuance authority Seednotes describe each layer.

Delegation is also where governance is hardest. Who may receive a prefix? What proof of authority must an applicant give, and how is a delegation revoked when an authority misbehaves or disappears? Document 08 requires that an authority prove its permission to issue, and that the registry support authenticated administration, auditable delegation changes, signing-key rotation, and revocation (§5.4). It does not set the policy for granting prefixes. That policy is a political decision about who participates in the federation, and Document 08 expects participation to be broad: organizations, individuals, communities, and institutions may join by registering appropriate namespace authority (§10.6).

Registries that can be replicated, not one database

The four logical registries — Prefix, Authority, Resource Identity, and Space — exist as separate contracts precisely so that they can be operated differently. A prefix registry is small and must be globally consistent; it is a natural candidate for wide replication. Resource identity records are numerous and are naturally partitioned by prefix, so each authority, or a registry operator acting for several, can hold its own partition. Space registrations sit in between. Document 08 also says the reference implementation should begin with a simple authoritative registry and add federation later as a compatibility-preserving extension (§5.5), which is a deliberate refusal to design the planetary system before the small one works.

Several partitioning strategies are compatible with those contracts, and each has a cost. Partitioning by prefix keeps an authority's records together and makes its stewardship clear, but a very large authority may need to subdivide further. Delegated sub-allocation within a prefix, which Document 08 allows where it is verifiably disjoint, spreads issuance load without new prefixes. Read replicas of identity records can sit close to the resolvers that use them. None of these choices touches the RID itself: an RID never says which server holds its record, and a resolver must never assume that its prefix names a host.

Resolution at scale: portable, verified, and cautious

Resolver portability is the second scaling mechanism. Many gateways, run by different organizations, may resolve the same RIDs, so resolution load and availability are not concentrated in one operator. Portability comes with a duty: every resolver must verify prefix authority, issuer or binding provenance, lifecycle, and the active space binding before relying on a remote representation, and must defend against redirects, server-side request forgery, and credential forwarding (§18.8). At scale, an unverified gateway is not a convenience but an attack surface.

Caching is the third mechanism, and the one with the sharpest privacy edge. Shared public caches may store public identity responses with explicit freshness bounds, but principal-specific or restricted representations must use non-shared cache controls, and caches must expire or be invalidated when bindings, keys, authority, lifecycle, or disclosure rules change (§18.8). Document 09 adds that public caches must never store principal-specific restricted responses, and that binding revocation, authority transfers, and policy changes require explicit invalidation or bounded freshness (Document 09 §7.6). In a federation with many caches, the hardest operational question is not how to cache more, but how quickly a revocation or a privacy change reaches every copy.

Privacy and abuse grow with the network

A small federation can rely on its members knowing one another. A large one cannot, and three abuse patterns become more serious as it grows. Enumeration — systematically probing identifiers to discover which exist — is limited by random suffixes, and Document 08 requires that a restricted identity whose existence may not be acknowledged produce the same response as one that does not exist, without revealing the difference through timing, headers, bodies, redirects, or caches where reasonably controllable (§18.7). Impersonation — an endpoint claiming authority it does not have — is countered by verified bindings, and human-friendly aliases must never be treated as security principals (§11.5). Namespace abuse — an authority issuing identities for referents it has no business describing, or flooding its namespace — is a governance problem: delegation must be revocable, and issuance is never ownership of what is identified.

People are where these risks are most acute. A planetary identity layer that made persons enumerable, or that let any authority issue identities for individuals without their knowledge, would be a surveillance instrument however carefully its syntax was designed. Document 08 provides the disclosure principles; it does not yet specify how an unaffiliated person obtains an RID, or the threat model for personal discovery, aliases, recovery, and consent (SPEC-01, SPEC-02). The Fieldnote Identifying without exposing explores what the disclosure rules already require.

Continuity outlives every operator

At scale, authorities will fail. A regional network will dissolve, a research consortium will lose funding, an agency will be reorganized. Every one of those events puts the identifiers it issued at risk unless someone has planned for it. Document 08 asks the federation to define mechanisms for preserving identifier mappings if an operator or organization permanently ceases operation (§9.6), and asks federation governance to establish procedures for registry continuity, namespace succession, backup and restoration, authority transfer, disaster recovery, and preservation of retired identity records (§16.4). Document 09 makes the operational side concrete for its prototype: backups and restoration tests that verify preservation of historical identifiers, name reservations, active bindings, delegation history, and tombstones (Document 09 §10.2).

For Cedar Valley, this would mean that if the fictional Cedar Valley Network authority ceased operating, a successor steward — another regional authority, a national body, or an archival institution — would take over its namespace records under an agreed procedure, so that Soil Probe 17, North Field, and the Water Stewardship Formation kept the identities that years of datasets and reports cite. The RIDs would not change; the authority records would show the succession with its effective date. Who that successor would be, and who decides, is exactly the kind of decision federation governance must make before it is needed.

What remains open, and what this Journal does not claim

The structural commitments are in place; the institutions are not. Document 08 has not chosen a legal steward for the registry, a policy for granting prefixes, a model for funding long-term operation, or a mechanism for mediating disputes between authorities. It has not specified the performance targets a global resolution service should meet, nor the privacy-preserving techniques that would let it meet them without enabling enumeration or profiling (SPEC-07). These are not omissions to be filled by an explanatory website. They are decisions for RSM Core and the communities that would rely on it, and this Journal's purpose is to show where they lie.

Two counterexamples mark the boundaries. It would be wrong to describe RSM ID as a single global database that stores everything about every referent: the registry holds identity records, Semantic Spaces hold knowledge, and Document 08 forbids requiring every lookup to contact one centralized database. And it would be equally wrong to treat delegation as a free-for-all in which any party may mint identities for anything: issuance requires registered, provable, revocable authority, and the existence of an identifier never confers ownership, consent, or access.

Conclusion: scale through federation, not concentration

The architecture's answer to scale is the same as its answer to everything else: keep each responsibility in its own place. Prefix allocation is global and small. Issuance is delegated and partitioned. Records are replicable under independently defined contracts. Resolution is portable but verified. Disclosure is decided per request, under policy, and caches respect it. Continuity is an institutional promise backed by procedures. None of these requires one operator to hold the world's identities, and none of them is yet operating.

For readers who want the parts in detail, The Anatomy of RSM ID explains the registries and resolution sequence, the Seednote on the Identity Registry summarizes the four logical registries, and the Viewgraph Registration and controlled issuance draws issuance under delegated authority. The Fieldnote Why identity is not ownership explains why none of this machinery makes anyone the owner of what it identifies.