Draft proposal · No agreement in place · Nothing has been awarded

Review proposal

Utah Life · a proposal to the Utah Board of Higher Education

Everything you earned here.
in your hands.

48,670 students, more Utahns than any other school in the state. UVU is the lead institution on both applications and the first of three universities to come online. It issues from its own keys under its own policy, and it cannot read, hold, or revoke what any other institution issued.

Explore the idea Funding details

Abstract

Utah Valley University is the lead institution on two linked applications to the Utah Board of Higher Education and the first of three universities to bring a node online. With 48,670 students it is where the student-facing work happens first: identity, payments, endorsements, reputation, agreements and credentials that a person holds and carries. UVU issues from its own keys under its own policy and cannot read what any other institution issued. Proposed UVU share across both applications: $1,875,000. No agreement exists and nothing has been awarded.

What you get

Eight things a student here can actually do

Start here. The rest of this page is how it works and who controls it, which matters, but this is what it is for.

01

Identity

Prove one thing without showing everything

A landlord who needs to know you are enrolled receives enrolled: yes. Not your transcript, not your address history, not your student ID number. You choose the one fact that answers the question, and the rest never leaves your phone.

02

Payments

Pay, get paid, and never pay a fee

Tuition, lunch, a parking pass, your paycheck from a campus job. No fee to you, no surcharge, no basis point, and nothing may be passed through to you. Today a $3,000 tuition payment by card costs a student around $88 in fees. Here it costs nothing.

03

Endorsements

When someone vouches for you, you keep the proof

A professor writes you a recommendation and you hold it, signed, verifiable, reusable. It does not live in somebody's inbox or expire when they change jobs. You decide who ever sees it.

04

Reputation

What you have actually done, and no score

Projects finished, hours served, skills demonstrated, all portable and all yours. No rating, no rank, no leaderboard, and nothing anybody can compute about you behind your back. You show what is relevant and keep the rest.

05

Agreements

Sign it and hold your own copy

Enrollment forms, housing leases, work agreements, waivers. Cryptographic proof of who signed and exactly what they signed, held by both parties and by neither one alone. No more asking an office to send you back a copy of something you signed.

06

Credentials

Prove what you earned, once, forever

Certificates, degrees, competencies. Verified in seconds by the next school or the next employer, without anyone phoning a registrar. Two-thirds of Weber State's associate-degree earners come back within a year for another credential, and every one of them currently pays a cost in time to prove something already true.

07

Community

Talk to people without the conversation becoming a product

Campus messaging, groups, and mail running on open protocols, on infrastructure your own university operates. Nobody is mining it, because there is no central place where it all sits.

08

Your own intelligence

An assistant that works from what you hold

It has no standing access to anything. When it needs authority it asks for exactly one thing, for one purpose, expiring, and you can take it back with one tap. Everything it did is written down where you can see it.

Why

Who holds your record,
and why that is
the whole question

Everything you use today works the same way. Some company or some office holds your record - your grades, your money, your signature, your messages, your face - and lets you look at it. You are the subject of the file, not the owner of it. That arrangement is not a law of nature; it is a design choice, made when there was no cheap way to prove something was true without a trusted middle. There is now.

A key is the thing only you have, that proves something came from you and nobody else. A node is just the place an institution keeps its own keys, so that no single school and no single company sits in the middle of everyone else - that is the entire mechanism, and everything else here is what it lets a person do: choose which fact to disclose, who receives it and for how long, and walk away from any provider without losing what you earned, because your university holds its own keys rather than renting them.

The best artificial intelligence can remain available, but it becomes a tool you aim not a party you are exposed to.

One network

Three universities, one standard, you in the middle

You are at the centre because that is where the record actually lives. The three universities are peers on one open standard, not branches of a platform: each holds its own keys, each can revoke only what it issued, and none of them can read the others. Take any one away and the other two keep working. Take away the company that built it and all three keep working, because the standard and the test suite are public.

UVU

Utah Valley University
uvu.life
Own keys

WSU

Weber State University
WEBER.University
Own keys

USU

Utah State University
USU.University
Own keys

THE OPEN STANDARD · NOBODY OWNS IT

KERI and ACDC · W3C Verifiable Credentials · OpenID4VP · the conformance test suite, published open source

Infrastructure

The reference node, the witnesses and watchers, the hosting for institutions that want it, the engineering team.

clear.host · contributed background technology · Utah-hosted · more than a decade of prior investment

Keys

The lock can change.
The address never does.

Everything on this page rests on one small piece of machinery: the keys that prove a record is yours. Four things are worth understanding, because each one answers a question a person actually asks. Where do my keys come from. What happens when one is stolen. What happens when I lose my phone. And how can an assistant use any of this without learning who I am.

01 · Origin
Derived keys

One secret on your device quietly produces a separate key for every place you use it. Nobody can connect them.

02 · Change
Rotating keys

Retire a key and name its successor without changing who you are on the network.

03 · Recovery
Key restoration

A lost phone is an inconvenience not the loss of your degree, your money, or your history.

04 · Delegation
Your intelligence hires theirs

Your own directed intelligence uses a large model without ever handing it who you are.

One root, many keys
Your root secret
  • Never leaves the device
  • Never sent to a server
  • Never seen by your university
Identity key
DKX7...9MQ2

Shown to the registrar

Payments key
DA3M...PV8L

Shown to campus merchants

Agreements key
DQP9...T4XC

Shown to a counterparty

Community key
DZT4...BR6N

Shown to the comms server

Derivation runs one direction. A key can be produced from the root, but the root cannot be worked backward out of a key. Because each party is handed a different key, two of them comparing notes learn nothing: the registrar and the campus store hold values that look unrelated. This is what an automated system cannot follow. A platform, or a model, that sees your key at one place and your key at another has no mathematical way to know they belong to the same person. There is nothing to stitch. You do not memorize any of this and you never type a key.

Never changes, not once
Signing key DKX7...9MQ2
In Force
Next key, sealed EJ9K...W2FS

Each entry in your record does two jobs. It signs with the key in force at that moment, and it seals a fingerprint of the key that will come next. The successor is committed before it is ever used, so a thief who takes today's key still cannot name tomorrow's. Rotating is a normal event in the log, not a new account.

Try a signature from the retired key

A verifier replays this log from the beginning. It accepts a signature only if the key was in force at the sequence number where the signature was made.

Survives a lost device
The phone you lost DQp9...t4Xc key held here
Your new phone nothing on it yet
Witness nodes holding your log. Any 3 of the 5 is enough.
UVU node BUV1...7RK4
idle
USU node BUS2...C9WM
idle
Weber State node BWB3...Q2LN
idle
State archive BST4...M6YD
idle
ClearFoundation node BCF5...V8HA
idle
agreement: waiting replayed: none

Not one of these nodes can read your record. They hold a signed log and confirm what order it happened in. No node can issue a key. Only your root can.

How it works
Never shown to any model
Your device
  • Root secret, never leaves your record, held here
  • Your rules, set by you
Your directed intelligence
  • Reads your record locally
  • Decides what to ask, and how little
  • Issues authority one grant at a time
The grant
  • Key: none yet
  • Purpose: compare two transfer paths
  • Discloses: credits earned, 64 credits
  • Not disclose: name, ID, grades
  • Expires: in 10 minutes
  • Revocable: one tap
A large model

Public, or private and non public

  • Sees: a fresh identifier
  • Sees: the question, the 64 credits
  • Never: your root
  • Never: your other keys
  • Never: your history
  • Never: standing access
State: idle

This is the difference between directed digital intelligence and artificial intelligence in one picture. Yours runs on your device, reads your record locally, and decides how little to ask. Theirs is very good at language and reasoning, and it gets exactly one scoped grant, under a key that was made for this request and will never be used again. When the grant expires the model holds nothing it could use to find you, and the next request arrives under a different key it has never seen. Public model or private one, the boundary is the same. You direct yours. Theirs hires theirs.

01
A stolen key is not a stolen life

Rotation retires the old key in the same record that names the new one. The theft becomes a dated line in your history instead of the end of it.

02
Old signatures keep standing

The log says which key was in force when, so a transcript signed two years ago still verifies after four rotations. No re-issuance, no fees.

03
Nobody can do it for you

Your university can issue a credential and witness your log. It cannot rotate your keys or sign in your place - and neither can the company that built this.

04
The model never learns who you are

Every request rides a key made for that request and never used again. Two requests share nothing a model could use to connect them.

When

What ships now, and what follows

Now · Both awards, year one
What ships first
  • Identity. prove one fact, not everything
  • Payments. no fee, no surcharge, ever
  • Endorsements. you keep the proof
  • Reputation. attestations, never a score
  • Agreements. signed, and you hold your copy
  • Credentials. degrees and certificates, verified in seconds
  • Community. on infrastructure your university runs
  • Your own intelligence. scoped authority, one grant at a time

Every one of these is a real transaction with a real current cost, which is what makes the measurement meaningful.

Phase II · Years two and three
What follows
  • Transfer articulation. credit accepted at the next institution, proven once
  • Voting, campus and association. student government, clubs, alumni bodies. Proof of eligibility is separated from the secret ballot. Public elections are out of scope and would need a separate certification and election-security program.
  • Housing. verified applicants and landlords, deposits and rent. Hard counsel gate under the federal and Utah Fair Housing Acts before this opens: no protected characteristics collected or inferred, no tenant scoring.
  • Transportation. transit, parking, verified carpool

Funded inside the awards where the application says so, gated by counsel where noted.

Later · Other issuers
When the issuer is not a university
  • Professional licenses. issued by state licensing boards, once those boards become issuers
  • Professional certifications. industry and board certifications, carried alongside academic ones

Not in either application. Listed so the roadmap is visible and the scope is honest.

SEDI

How this follows Utah's statute

Utah's State-Endorsed Digital Identity statute, SB 275 as amended in February 2026, sets requirements. Digital World's Engineering Specification, the LIFE Standard Reference Architecture, maps each of them to a shipping component and keeps a reference installation in Utah for exactly that purpose. This project is the first independent, instrumented test of whether the mapping holds at population scale.

Requirement How this project meets it Where it is tested
Right to create and own a digital identity Root identity created on the person's device and owned by them. No university, agency or company creates it for them. Reference implementation, all three nodes
Right to control data and likeness The vault, the credentials and the persona scopes are the person's. Institutions issue into them and cannot read across them. Control section; conformance suite
Right to selective disclosure Every credential supports partial attribute disclosure natively. A full document is never presented when one attribute answers the question. Minimization study, HERFP Objective 3
Right to persona separation Derived keys, one per relationship, enforced at the data layer rather than only in the interface. Two parties comparing notes learn nothing. Keys section, panel 01; margin studies

The statute says identity is inherent to the person rather than conferred by government. The specification's first rule says the same thing in different words: the member always owns the identity, profile, credentials, data, personas, likeness, graphs, relationships and assets; the provider supplies infrastructure, not ownership. The conformance suite this project publishes is what turns that shared sentence into something a state procurement officer can check.

Specification: Digital World Engineering Specification v3, section 16, State-Endorsed Digital Identity. Published at docs.digitalworld.earth. The framework is contributed background technology in both applications; the conformance suite built against it is a funded deliverable released open source.

Control

What UVU controls, and what it cannot

Its own signing keys

Held in UVU-controlled hardware security modules. Not held by the industry partner, not held by the network, not escrowed anywhere by default.

Its own issuance policy

Which credentials it issues, to whom, on what evidence, and for how long. Written by UVU, changeable by UVU.

Its own revocation registry

UVU can revoke what UVU issued. That is the whole scope of its revocation authority.

Its own integrations and access decisions

Which campus systems connect, which verifiers are recognized, and what a student sees inside UVU's own app.

Nothing another node issued

UVU cannot read, hold, or revoke a Weber State certificate or a Utah State degree. It can verify one, like any other verifier, if the student chooses to present it.

No student's wallet

The credentials live on the student's device. UVU issues them and then does not hold them.

No verification log

UVU cannot produce a list of where a student presented a UVU credential. Neither can anyone else.

Role

The deployment node

UVU enrolls more Utahns than any other institution in the state. That is the reason this node goes first and goes deepest: no other campus in Utah can run a population-scale deployment study without leaving the state.

UVU is also the home of the principal investigator and the prime recipient on both applications. The student-facing work happens here, the first credential types are issued here, and the six student companies are formed here.

48,670

students enrolled, fall 2025

UVU

45,900+

of them Utah residents

UVU

1,151

graduate students, past 1,000 for the first time

UVU

60

students working on the project across all three nodes

Proposed
Issuance

What this node issues, in the order it is built

Credential What it proves Attributes released State
Enrollment Currently enrolled, this term enrolled: yes Q3, year 1
Academic credential Degree conferred, field, date credential type, field, date Q5
Competency A specific demonstrated skill competency identifier only Q10
Transfer articulation Credit accepted toward a named program course equivalence set Q6 pilot
Agreement An agreement signed, with proof of who signed agreement hash, signer proof Q11

The attributes column is the point. A landlord who needs to know a person is enrolled receives enrolled: yes, not a transcript. That is what the statute means by minimum necessary, and measuring whether it holds up in practice is one of the project's research objectives.

Scope

What UVU is funded to do, and for how much

Work Award Amount
Prime recipient, all UVU personnel, students, equipment, evaluation HERFP $1,400,000
Prime recipient, project lead, faculty, students, delivery AI Moonshot $475,000
Six student venture fellows, each gated on one real customer HERFP within the above
Institutional cost share offered both $380,000
On the student companies

Six paid venture fellows pursue six commercialization tracks. A track advances to company formation only if it has one paying or committed customer outside the project. Students own their intellectual property. The industry partner takes no equity, no assignment, and no right of first refusal.

Zero fees

What this costs a student, and
what it costs the institution

Nothing, and then a subscription the institution can decline.

Students pay no fee, no surcharge, no basis point, and nothing may be passed through to them. The institution pays nothing per transaction either. There is no revenue share anywhere in this model. Earlier drafts of the campus proposal carried a one percent fee on rewards and stored value split between the provider and the university; it has been removed.

Layer Who it serves Price
uvu.life The person: wallet, credentials, agreements, reputation, the agent $0
uvu.host The institution: node, witnesses, verification capacity, communications and community servers Subscription, optional

Two things make zero credible rather than a slogan. This institution can run its own node, because the specification and the conformance suite are published open source, so hosting is a convenience and not a lock. And the keys stay here whether it self-hosts or subscribes, so buying hosting never means handing over authority. Hosting is the sustainability model after the award, not something the grant pays to build.

Network

Where this sits

Every node runs the same open standard and holds its own keys. A credential issued here verifies anywhere without calling back to this institution, and this institution cannot read or revoke what another node issued.

utah.education

The shared standard, the wallet, and the trust framework.

Network
uvu.life

Primary deployment. 48,670 students, the largest in Utah.

Node
usu.life

Rural and statewide validation. Extension in all 29 counties.

Node
wsu.life

Stackable credentials and independent replication.

Node