Notifications
Clear all
Topic starter
12/07/2026 12:21 pm
TL;DR: Prove’s move into the Better Identity Coalition reflects a broader shift in digital identity: static, point-in-time checks are no longer enough when fraud, account takeover, and agent-mediated actions can occur across the full user journey, according to Prove Identity. Continuous verification and privacy-aware governance now matter as much as authentication itself.
NHIMG editorial — based on content published by Prove Identity: Prove joins the Better Identity Coalition and argues for privacy-first digital identity
By the numbers:
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security.
Questions worth separating out
Q: How should organisations govern identity trust after onboarding is complete?
A: Organisations should treat onboarding as the start of identity governance, not the end of it.
Q: Why does digital identity need privacy controls as well as stronger verification?
A: Stronger verification can still fail governance if it collects too much personal data or reuses it outside the original purpose.
Q: Where do identity programmes fail when actions can be taken on behalf of a user?
A: They fail when delegated authority is treated as a permanent extension of the person rather than a governed entitlement.
Practitioner guidance
- Define separate controls for identity proofing and session trust Map onboarding, recovery, and post-login trust decisions into distinct policy steps so the same verification event is not reused as blanket authorization for every later action.
- Limit identity data to the minimum required for each use case Review which attributes are actually necessary for account creation, authentication, or assurance decisions, then remove unnecessary collection, storage, and reuse paths.
- Treat delegated actions as governed entitlement paths Create explicit policy for actions taken on behalf of a user, including revocation, auditability, and provenance checks, rather than assuming user identity alone is sufficient.
What's in the full article
Prove Identity's full blog covers the policy detail this post intentionally leaves at a higher level:
- How Prove frames the Better Identity Coalition’s role in shaping digital identity policy and standards
- The article’s discussion of continuous verification, privacy-aware design, and trust across agent-mediated actions
- Mitch Bompey’s explanation of where security, equity, and consumer trust intersect in identity governance
- The specific way Prove describes its own identity graph and persistent verification model
👉 Read Prove Identity's blog on joining the Better Identity Coalition →
Digital identity governance: what continuous trust changes for teams?
Explore further
12/07/2026 12:34 pm
Continuous trust is becoming the new baseline for digital identity governance. Static verification is increasingly inadequate when the same identity must be trusted across onboarding, login, recovery, and delegated activity. The governance failure is not authentication alone, but the assumption that one proof point can safely cover the whole lifecycle. Practitioners should move toward continuous assurance models that distinguish between identity establishment and identity trust.
A question worth separating out:
Q: Who is accountable when a digital identity platform is used for fraud or unauthorised changes?
A: Accountability usually spans the identity operator, the relying service, and the organisation that owns the recovery or modification process. When identity is shared infrastructure, responsibility cannot stop at login. Governance must cover enrollment, mutation, consent, and offboarding, because any weak handoff can become the attacker’s entry point.
👉 Read our full editorial: Digital identity governance moves from point checks to continuous trust
