Even after Identity establishes who an Actor is and Authorization defines the Actor’s Authorized Scope, this is not sufficient. Actors with the same Identity and Authority may still differ in the extent to which they can be relied upon.

This is where Trust becomes relevant. Trust does not classify an Actor as permanently “trustworthy” or “untrustworthy.” Rather, based on Facts and Evaluations associated with the Actor, it represents a Governance Evaluation of the extent to which that Actor can be relied upon in a particular Context.

Multiple factors can contribute to Trust. History may include Past Activities, Track Record, Provenance, and Incident History, while Qualification may include Role, Certification, Skills / Expertise, and Training Completion. Peer / Expert Review, Ratings / Scores, Compliance Status, and Risk Assessment may also be referenced.

Trust is not determined solely by historical information. Current Behavior may also be evaluated through factors such as Consistency, Policy Adherence, and Anomaly Detection. An Actor that previously had a high level of Trust may therefore experience a change in Trust Level as a result of subsequent Behavior or Incidents.

These elements can be used to form Trust Levels such as High Trust, Medium Trust, and Low Trust. Such levels, however, are not permanent judgments attached to an Actor’s character. They are treated as Evaluations that can be updated based on available Evidence and Context.

Identity and Trust are therefore clearly distinct:

Identity tells us who the Actor is.

Trust tells us how much the Actor can be relied upon in a given Context.

Trust is also distinct from Authority. Possessing Authority does not imply a high level of Trust. Conversely, even an Actor with a high level of Trust cannot perform an Action outside its Authorized Scope without the necessary Authority.

Accordingly, Identity, Authority, and Trust represent distinct Governance Dimensions. Separating them prevents the questions of “who the Actor is,” “what the Actor has Authority to do,” and “how much the Actor can be relied upon” from being conflated, allowing them to inform Governance Decisions according to the relevant Context.