Trust signal

A trust signal is a verifiable fact about an identity's current state that a system can weigh in an access decision: how long the current SIM has been on a phone line, whether a passkey assertion verified, whether a credential appears in a breach corpus. Signals differ from scores in that each one is individually attributable and auditable.

Attributability is what separates a signal from a score. When a decision is reviewed months later, a signal can be re-stated as a fact with a source and a timestamp: the SIM changed four hours before this transfer, per the carrier. A score cannot be re-derived without the model that produced it, which may since have been retrained.

Signals also differ in how hard they are to forge. A device fingerprint is assembled from data the client supplies; a carrier signal originates in infrastructure the attacker does not operate. Weighting them identically discards that difference.

A signal's weight should reflect where it comes from, and the useful axis is who would have to be compromised to forge it. A device fingerprint is assembled from data the client supplies, so the client can lie; a carrier signal originates in network infrastructure the attacker does not operate, so forging it means compromising a carrier. Both arrive as a field in a JSON response, which is exactly why the distinction has to be carried deliberately rather than left to whoever writes the rule.

Signals also need an explicit third state. Present, absent and unknown are three different facts, and a system with two branches will map unknown onto one of the others, almost always the permissive one. Carrying unknown through to the rule, and deciding there what it means for this particular action, is the difference between a control and a control-shaped object. Where the signal is old rather than missing, signal freshness decides whether it should be read as a weak yes or as no answer at all.