Attestation (identity)

An attestation is a signed statement by a verifier about facts it checked at a specific moment: this passkey assertion was valid, this phone line had not been swapped, this device posture met policy. Because it is signed and timestamped, an attestation is portable evidence that a check happened, not merely an access decision.

Attestations differ from tokens: a token grants access, an attestation records verified facts. Systems that keep signed attestations can answer, months later, exactly what was known at decision time, which is what auditors and dispute processes actually ask for.

The evidentiary value depends on what the signature covers and how long it stays checkable. An attestation over a decision alone answers less than one that also binds the inputs, the policy version and the time, because a reviewer's question is usually why this was allowed rather than whether it was. Binding those inputs as digests rather than values keeps the record useful without turning an audit trail into a second copy of the personal data, which is the data minimization form of the same argument.

Longevity is the other half, and it is a cryptographic question rather than a storage one. An artifact a regulator may examine in eight years has to be verifiable then, under whatever is signed today, which is the harvest now, decrypt later exposure applied to evidence rather than to traffic. Signing long-lived attestations with a post-quantum layer alongside a classical one, as hybrid signatures do, is what keeps the record checkable across an algorithm migration, since re-signing later proves only what the artifact says now.

Storage is the mundane constraint that decides whether any of this survives contact with production. Attestations accumulate at the rate of decisions, post-quantum signatures are kilobytes each, and a retention period set by a regulator rather than by an engineer is measured in years. Sizing that early is cheaper than discovering it during the first audit that asks for a full year of evidence.