Understand the standards and assurance boundaries behind Zoiko iD.
Explore the identity, authentication, delegated authority and evidence
standards relevant to Zoiko iD’s architecture. Review implementation
scope and published assurance information where verified, and follow
authoritative technical or Trust Center sources for details.
Six statuses, each with a precise meaning
A status is always shown as text, with its scope and the date it was last reviewed. A standard name alone never
sets a status.
Intended design
mind. Not a statement of production support.
Roadmap intent
available.
Verified capability
Outside review
scope and date are named.
Certification
scope, date and validity.
Unknown status
Protocol names are not guarantees. Listing a protocol means it is a subject of the taxonomy. Production support is shown only where an approved
capability record exists.
Search and filter the standards registry
Results are read from an approved registry. Each result shows its status, scope, version where confirmed, and the
date it was last reviewed.
0 standards match these filters
No standards match these filters
A missing result is not evidence that a standard is unsupported. Clear filters, or ask
an identity expert about a specific standard.
Default sort: curated relevance. Alternatives: alphabetical, last reviewed.
Every entry carries the same fields
Each entry below shows the fields it must display. Until a verified record exists, its status reads as not publicly
confirmed.
Protocol entry
Scope, component, actor type, edition, limitations and the owning documentation.
Credential entry
Issuer, verifier and assurance-level terminology,
with its boundaries.
Agent entry
Principal, sponsor, mandate and revocation
concepts for non-human actors.
Protocol subjects, with their status
The protocols below are subjects of the standards taxonomy. None is
listed as a confirmed production capability on this page.
| Protocol | Role in the design | Status |
|---|---|---|
| OAuth 2.0 | Delegated token issuance | NOT PUBLICLY CONFIRMED |
| OpenID Connect | Federated sign- in | NOT PUBLICLY CONFIRMED |
| SAML | Enterprise federation | NOT PUBLICLY CONFIRMED |
| SCIM | Directory provisioning | NOT PUBLICLY CONFIRMED |
| Security-event frameworks | Signals about trust changes | NOT PUBLICLY CONFIRMED |
Authentication & passkeys
WebAuthn and FIDO2 are concepts in the
taxonomy. Their presence in a design does not
confirm a deployed implementation.
Verifiable credentials
Issuer and verifier roles are distinct. A
credential proves a claim; it does not prove
legal eligibility.
Authority is evaluated
separately from identity
A machine or AI agent may be identified without being authorized for
anything. Mandate, sponsor, scope, expiry and revocation are the controls that govern its actions.
Applicability is scoped, never assumed
Whether a regulation applies depends on the entity, the activity and the jurisdiction. Product capability does not establish that a regulation is satisfied.
Notice.
Five terms that are often confused
Each term means something different. A design that follows a standard is not the same as a certificate issued for it.
Standard
A published specification or
framework.
Alignment
Design that follows a
standard, without a formal
result.
Certification
Issued by a certifying body,
with validity.
Report
The document itself,
released only when
approved.
From a standards card to a reviewed request
The Trust Center owns authoritative assurance records. This page offers a governed link or a request, never direct
access to a restricted file.
Find
Open a standards card
and view evidence.
Scope
Title, edition, date and
visibility.
Sign in
Restricted items use an
authorized flow.
Request
Organization, email,
purpose and asset.
Receipt
Reference shown after
server confirmation.
Decision
Approved, denied, more
information, or revoked.
Access
Time-limited and checked
at access.
A receipt is not an approval. Confidential documents are never placed in URLs, analytics, email, cache or source HTML.
Questions to bring to a scoped review
Scope questions
Evidence questions
Every state is shown in plain language
A missing or unavailable record is never presented as a current, complete picture.
Source unavailable
Standards information is
temporarily unavailable. Public
links remain.
Withdrawn
The claim is withdrawn. No
download, and no stale status is
shown.
Restricted
Access requires an authorizedrequest. No preview is shown.
Under review
The claim is not approved for
publication and is flagged as such.
Frequently asked questions
Find answers to common questions about Zoiko iD
What standards does Zoiko iD support?+
How can procurement review evidence?+
How do implementation statuses change?+
Does standards alignment mean certification?+
How is delegated authority different from authentication?+
Does a missing standard mean it is unsupported?+
Explore the technical documentation, or talk to an identity expert.
Developers can start with the developer documentation.
Enterprise teams can discuss a scoped review with an identity
expert.
Developer docs
Trust Center