User Engagement

From IDESG Wiki
Jump to navigation Jump to search

Full Title or Meme

This topic takes the concept of User Experience to a deeply interactive with the user over time that is intended to help Kantara plan for the next phase of development.


A proposal is in process to extend the Service Assessment Criteria for NIST SP 800-63 into a Trust Registry API for Mobile Applications that act as the User Agent. The existing proposal addresses the first phase of a user experience in acquiring a User Agent that will honor their intent.

The next phase will be the development os specification to the the current set of specification together into a complete package of all of the user attributes, and only those attributes that are required to establish and retain a relationship between one user and one relying party.

What this is NOT about

  • User Engagement is also a term used by marketers to mean user manipulations. This is a technical discussion about the interaction of users with their technology choices.
  • Pathient Empowerment is about asserting what a healthcare patient CAN do. This is a discussion about what a user SHOULD do.


Identity Proofing

Is the process of binding and identifier to a real-world person. At its core this is just a comparison of biometric factors of the real-world person to user credentials that are accumulated over a user's life-time.

User Authentication

This is the traditional role for an Identifier provider (IdP). In some ways it becomes an anachronism as we disassemble, enhance and reassemple the parts into a complete User Engagement.

User Informed

The Relying Party has give the user the information needed to decide to proceed with engagement.

User Intent

Consent to share data to achieve objectives.

User Agent Trust

  • The application that is interactive with the RP on the user's behalf is know to protect the user's secrets and intent.


  • Typically this will be real-time identity proofing against biometrics attributes performed in the user agent application software.


  • The user reamains engaged in the session and is not replaced by someone else.


  • User attributes (claims) are still valid.


  • The biggest challenge is to adequately address the preservation of User Rights in digital interchanges.
  • If the user expectations are not met because of the actions of some bad actors, the users will reveal against the technology and demand better treatment.


Kantara already has a deep reservoir of experience in the development os specification on the User Experience that can serve as a basis for the next steps.

  1. User Managed Access
  2. Consent Receipt
  3. Mobile Authentication Assurance Statement.
  4. Privacy and Identity in Mobile Driver's License

The path forward

The objective is to ensure that User Engagement works to the benefit of both the user and the RP. Each party must feel that their needs are adequately met and that one side is not taking advantage of the other.

  1. The consent receipt is being expanded into
    1. a consent record.
    2. a generalized notification.
  2. The MAAS is being bound, in-real-time, into:
    1. proof that the user is present at the device
    2. proof that the software running on the device is same code that received the MAAS