Standard for detecting spoofing attacks against biometric systems — photos, masks, deepfakes, video replay. Certified component, in production today: VAC integrates Didit passive liveness, an independently certified PAD detector — iBeta Level 1 PAD under ISO/IEC 30107-3, with a 0% attack-success rate across 360 attempts (0% IAPAR), tested by iBeta Quality Assurance, a NIST/NVLAP-accredited lab (NVLAP code 200962), compliance letter dated 4 Feb 2026. Level 1 covers presentation attacks — print, screen, and replay.

On top of that, VAC's own 7-modality engine (face liveness, deepfake detection, speech match, lip-sync, challenge response, finger gesture, duress) adds cross-modal binding — face, voice, and gesture bound in a single act — as defence-in-depth, including against injection attacks that single-detector presentation-attack testing does not cover. VAC's own ISO 30107 certification is planned for Q4 2026 (see timeline below).

Defines four levels of authentication assurance (LoA 1-4). VAC's adaptive modality system is designed to map onto them: streamlined verification (inside trust graph) onto LoA 2, full 7-modality onto LoA 4. An assurance level is determined formally with your auditor against your deployment — not a value any vendor self-declares. Trust graph density dynamically drives the modality set.

NIST's emerging framework for AI agent identity, authorization, and accountability. VAC Protocol submitted to the RFI (March 2026) positioning cryptographic delegation chains and trust graphs as the architectural foundation for agent accountability.

Standard for self-sovereign identity and verifiable credentials. VAC's trust graph architecture aligns with DID's model of decentralised trust relationships. Verifiable Authority Tokens (VATs) implement the verifiable credential pattern with cryptographic delegation chains.

Industry-standard security audit covering data handling, availability, processing integrity, confidentiality, and privacy. Required by enterprise customers before procurement. Estimated cost: $50K-$150K per audit cycle. Planned post-revenue.

European standard for identity verification in trust services, aligned with eIDAS regulation. Covers video identification, automated identification, and KYB verification. Required for EU market entry. Certification through accredited European bodies.

Passwordless authentication standard using biometrics and hardware keys. VAC's biometric verification can serve as a FIDO2 authenticator, enabling passkey-based authentication backed by the full VAC trust graph and delegation chain.

VAC defines its own standards for trust graph verification economics: inside graph (streamlined — a single modality), outside graph (full verification — the complete modality set). Density thresholds determine when verification cost reduces. These standards are part of the protocol specification and white paper.

Monotonic narrowing: permissions can only restrict, never expand, without human re-verification. Maximum delegation depth, scope inheritance rules, and revocation propagation are defined in the protocol spec. These constraints are mathematically enforced, not policy-based.