An Authorized vLEI Representative (AVR) is a representative of a Legal Entity who is formally authorized by the entity's Designated Authorized Representative (DAR) to request the issuance and revocation of vLEI credentials on behalf of that Legal Entity within the GLEIF vLEI Ecosystem Governance Framework.
Source Governance Framework: Draft vLEI Ecosystem Governance Framework Glossary (v0.9, February 7, 2022) published by GLEIF
Governance Context
Position in vLEI Ecosystem Hierarchy
The AVR role occupies a critical operational position within the vLEI credential issuance chain:
:
Implementation Notes
Governance Implementation
Authorization Establishment: Organizations must implement formal procedures for DAR designation of AVRs, including documentation of authorization scope, validity periods, and revocation conditions. This typically involves legal agreements, organizational policies, and cryptographic key management infrastructure.
Multi-Signature Coordination: When multiple AVRs exist, organizations should implement threshold signature schemes using KERI multi-sig capabilities. The governance framework recommends at least 3 AVRs with a 2-of-N threshold for enhanced security, though single-signature configurations are permitted for sole proprietorships.
Credential Request Workflows: AVRs should establish standardized procedures for credential requests, including:
Pre-request validation of LEI status
Coordination with Legal Entity Authorized Representatives (LARs) for signatures
Verification of credential schema compliance
Submission through approved vLEI software implementations
Revocation Monitoring: Organizations must implement systems to monitor revocation triggers, including:
LEI status changes in the Global LEI System
Employee role changes and departures
Security incident detection
Governance compliance violations
Audit and Compliance: All AVR actions should be logged in verifiable audit trails, with regular reviews to ensure governance framework compliance. Organizations should maintain documentation of:
AVR designation and authorization records
Credential issuance and revocation requests
QAR interactions and responses
Security incidents and remediation actions
Technical Infrastructure: AVRs typically require:
KERI-compatible key management systems (KERIA agents, Signify clients)
Secure communication channels with QARs
Access to TEL registries for credential status verification
Integration with organizational identity and access management systems
Operational Considerations: Organizations should define clear escalation procedures for:
Emergency revocation scenarios
Key compromise incidents
Disputes with QVIs or QARs
Governance framework interpretation questions
Hierarchical Structure
GLEIF Root - Establishes the root-of-trust for the vLEI ecosystem
Authorized vLEI Representative (AVR) - Operational representatives designated by the DAR
The AVR serves as the operational interface between the Legal Entity and the QVI/QAR for credential lifecycle management. While the DAR holds ultimate authorization authority for the Legal Entity, AVRs execute the day-to-day credential management operations.
GLEIF Ecosystem Integration
The AVR role is integral to GLEIF's mission of providing verifiable organizational identity through the Legal Entity Identifier (LEI) system. The vLEI ecosystem extends the traditional LEI framework into the decentralized digital identity space using KERI protocol infrastructure.
Key Ecosystem Relationships:
Legal Entity: The AVR acts on behalf of a specific Legal Entity with a valid LEI
DAR: The AVR receives authorization from the DAR through formal designation
QAR: The AVR interacts with QARs to request credential operations
KERIA Agents: Cloud-based KERI agents that manage AIDs and key events
Signify Clients: Client applications for signing and credential management
QVI Systems: Interfaces for submitting credential requests to QVIs
TEL Registries: Systems for querying credential status
Security Best Practices
Key Protection:
Use hardware security modules (HSMs) or trusted execution environments (TEEs)
Implement key rotation schedules
Maintain offline backup keys
Access Control:
Implement least-privilege access for AVRs
Use multi-factor authentication
Monitor and log all AVR actions
Incident Response:
Establish procedures for key compromise
Define rapid revocation workflows
Maintain communication channels with QARs
Operational Challenges
Coordination Complexity: Managing multi-signature requirements across multiple AVRs and LARs requires robust coordination mechanisms.
Temporal Constraints: Credential validity periods and grace periods require proactive monitoring and renewal processes.
Governance Evolution: As governance frameworks evolve, AVRs must adapt procedures to maintain compliance.
Interoperability: Ensuring compatibility across different vLEI software implementations and QVI systems requires adherence to standards.