ProtectedSubjectPolicy

DID service type defined by IGCT-Kynexis. Application-defined (W3C DID Core §5.4); processed by systems configured to read it.

Service entry

{"id": "<did>#protected-subject", "type": "ProtectedSubjectPolicy",
 "serviceEndpoint": "https://<host>/.well-known/protection/lattice-policy",
 "definition": "https://indigenousprotocolministry.io/ns/protected-subject-policy"}

Endpoint content

JSON lattice policy published by the DID controller. Key protectedSubject: name, variants, matchRule, variantRule, onMatch, metadataEnforcement. Instrument effects and external conditions per instrument. The same policy is bound by digest (policyDigest) into the signed graph credential at /.well-known/protection/graph (W3C VC 2.0, eddsa-jcs-2022).

Processing

1. Resolve the DID; take the service of this type.
2. Fetch /.well-known/protection/graph; verify the proof against the DID's assertion key.
3. Fetch the endpoint; confirm SHA-256 of its JCS form equals policyDigest in the verified graph.
4. Apply matchRule to names in the record being processed; on match apply onMatch and each instrument's effects, with its elements outstanding and the performance owed as published.
5. Check status at /.well-known/protection/status-list.

Records CC BY-NC-ND 4.0; retain NOTICE.