From Evidence to Eligibility: A Privacy-First Architecture for Interoperable Eligibility Verification

Eligibility verification (deciding whether a person satisfies a policy-defined predicate) is a common pattern across banking, digital assets, insurance, government, and online platforms. Many deployed approaches retain documents and extracted attributes, creating breach targets long after the decision point. We present a privacy-first, standards-native architecture that converts transient onboarding evidence into reusable eligibility outcomes without durable plaintext personally identifiable information (PII) storage at the Issuer. The user establishes credential-derived key custody; the Issuer produces signed measurement claims from document and liveness checks; the client proves required predicates without revealing underlying values; and relying parties consume outcomes via OAuth 2. 0/OpenID Connect (including Identity Assurance verifiedclaims) and OpenID4VC flows. When repeatability is required, a minimal set of verified attributes is retained only in encrypted form. Under Issuer compromise, an attacker obtains ciphertexts and integrity artifacts rather than plaintext evidence.