{"v":1,"type":"constitution","issuer":"did:key:z6MkgZjBKJTVBdvEkD5K84SDZGL4qCDfbPF5LsuSgVKYWWpx","name":"Zanii ID operating rules","rules":[{"id":"no-operator-email","effect":"forbid","targets":["identity.email_set_by_operator"],"note":"An operator may never set a user's email; only the old inbox's revert link or the user can."},{"id":"no-password-read","effect":"forbid","targets":["identity.password_read","identity.credential_export"],"note":"Passwords are hashed; nothing may read or export them."},{"id":"mfa-reset-needs-reason","effect":"require_approval","targets":["identity.mfa_reset_by_operator"],"note":"Operator MFA reset only with a recorded out-of-band verification reason (auditable)."},{"id":"identity","effect":"allow","targets":["identity.*"],"note":"The IdP's privileged actions on accounts."},{"id":"consent","effect":"allow","targets":["consent.*"],"note":"PDPL consent receipts."},{"id":"retention","effect":"allow","targets":["data.retention.*"],"note":"Deletion attestations and retention holds."},{"id":"age","effect":"allow","targets":["age.*"],"note":"Age-assurance outcomes from a configured provider (never a document)."},{"id":"kya","effect":"allow","targets":["kya.*"],"note":"Know-your-agent screening decisions at token exchange."},{"id":"subprocessor","effect":"allow","targets":["subprocessor.*"],"note":"Onward transfers to declared sub-processors (mail)."},{"id":"residency","effect":"allow","targets":["residency.*"],"note":"Daily hosting-region claims."}],"default":"forbid","created_at":"2026-09-05T09:37:15Z","sig":"ed25519:61927095c0d524e0e5c10e90ea3d32b396ecf595223f6a97951b7283768ca439c8ce150f47b39ad7beebaf66f7656f527f33d64f4e473e59bbc97d3bf43f6d09"}