Loading vLEI.wiki
Fetching knowledge base...
Fetching knowledge base...
This comprehensive explanation has been generated from 19 GitHub source documents. All source documents are searchable here.
Last updated: October 7, 2025
This content is meant to be consumed by AI agents via MCP. Click here to get the MCP configuration.
Note: In rare cases it may contain LLM hallucinations.
For authoritative documentation, please consult the official GLEIF vLEI trainings and the ToIP Glossary.
A hierarchical delegation architecture in KERI where a single delegator can have multiple delegates, and each delegate can recursively act as a delegator for its own delegates, forming nested delegation trees that enable elastic horizontal scalability while maintaining cryptographic verifiability throughout the hierarchy.
Multi-valent describes a delegation pattern in KERI that enables hierarchical scalability through multiple simultaneous delegation paths. The term "multi-valent" (from Latin multus meaning "many" and valens meaning "strong" or "capable") refers to the capability of a single delegator to maintain multiple active delegates concurrently, with each delegate potentially serving as a delegator for its own set of delegates.
This creates a nested delegation tree structure that can extend to arbitrary depth, where:
The multi-valent pattern is explicitly contrasted with simpler delegation models:
Delegation Policy Design: Organizations implementing multi-valent delegation must establish clear governance policies defining:
Operational Coordination: Establishing delegation relationships requires coordination between delegator and delegate to ensure both parties create the necessary cryptographic commitments in their respective KELs.
Security Architecture: Organizations should design delegation hierarchies to match security requirements:
Monitoring and Audit: Multi-valent delegation trees should be monitored for:
Flat vs. Hierarchical: Organizations must decide whether to use flat delegation (all delegates directly from root) or hierarchical delegation (nested levels). Hierarchical provides better organizational alignment but increases verification complexity.
Delegation Breadth: The number of delegates at each level affects scalability and fault tolerance—more delegates enable greater parallelism but increase coordination complexity.
Mixed Security Models: Multi-valent trees can incorporate different security models at different levels, but transitions between security levels must be carefully managed to avoid creating vulnerabilities.
Revocation Strategy: Organizations should plan revocation strategies that minimize operational disruption—revoking high-level delegates affects all downstream delegates, so careful coordination is essential.
Elastic Horizontal Scalability: The ability to add multiple delegates at any level enables workload distribution and parallel processing without architectural constraints.
Recursive Hierarchical Structure: Each node in the delegation tree can serve dual roles—as a delegate receiving authority from above and as a delegator granting authority below.
Organizational Alignment: The delegation tree structure can mirror real-world organizational hierarchies, enabling digital identity infrastructure to match corporate, governmental, or institutional structures.
Cryptographic Verifiability: Despite the complexity of multi-level, multi-branch delegation, every delegation relationship maintains end-to-end cryptographic verifiability through KEL anchoring and cooperative delegation commitments.
Multi-valent delegation applies specifically to AID control authority delegation within KERI. It does not refer to:
The multi-valent pattern operates at the identifier control layer, establishing who can perform key management operations for which identifiers, rather than what data or resources those identifiers can access.
The concept of hierarchical delegation in identity systems predates KERI, with roots in:
Traditional Public Key Infrastructure (PKI) systems like X.509 certificate chains implement hierarchical trust through:
However, traditional PKI suffers from critical limitations:
Blockchain-based identity systems introduced algorithmic trust through:
These approaches improved on administrative trust but introduced new problems:
The development of self-certifying identifiers (SCIDs) and autonomic identifiers (AIDs) enabled a new approach:
KERI's multi-valent delegation builds on this foundation, as articulated in Samuel Smith's Universal Identifier Theory whitepaper, which establishes the theoretical framework for hierarchical autonomic identifier management.
KERI implements multi-valent delegation through its cooperative delegation protocol, where both delegator and delegate must participate in establishing the delegation relationship:
Delegator Commitment: The delegator creates a cryptographic commitment in either a rotation event or interaction event via a seal that references the delegate's establishment event.
Delegate Commitment: The delegate creates a cryptographic commitment in its establishment event via a seal that references the delegating event from the delegator.
This bidirectional commitment ensures:
The multi-valent pattern enables what the source documents call a "multivalent key management infrastructure"—a system that maps key management responsibilities to hierarchically structured organizational computing infrastructure.
Flexible Security Trade-offs: Different levels in the delegation hierarchy can implement different security policies appropriate to their organizational role:
Performance Optimization: Workload distribution across multiple delegates enables:
Organizational Alignment: The delegation tree structure can mirror real-world organizational hierarchies:
The recursive nature of multi-valent delegation creates powerful compositional properties:
Arbitrary Depth: There is no architectural limit to delegation depth—trees can extend as deep as organizational requirements demand.
Mixed Security Models: A single delegation tree can incorporate:
Compromise Recovery: The bivalent pattern can be applied within multi-valent trees, where each layer wraps the next with compromise recovery protection, maintaining root-layer security properties throughout the hierarchy.
Independent Key Management: Each entity in the delegation tree maintains its own independent key management infrastructure—no sharing of private keys is required, and each party generates and stores keys using systems appropriate to their security requirements.
KERI's multi-valent delegation differs fundamentally from traditional hierarchical identity systems:
Cryptographic vs. Administrative: Traditional PKI relies on organizational policies and procedures to enforce delegation rules. KERI uses cryptographic commitments in KELs that are mathematically verifiable without trusting any administrative authority.
Portable vs. Infrastructure-Locked: Traditional certificates are bound to specific CA infrastructure. KERI AIDs and their delegation relationships are portable—they can be verified anywhere without dependence on the original infrastructure.
End-Verifiable vs. Trust-Dependent: Traditional systems require trusting intermediate authorities. KERI enables end-verifiable delegation chains where any party can cryptographically verify the entire delegation path to the root.
Cooperative vs. Unilateral: Traditional delegation is often unilateral (the delegator grants authority). KERI requires cooperative participation from both delegator and delegate, preventing unauthorized delegation claims.
Event-Based vs. State-Based: Traditional systems maintain current state in databases. KERI maintains complete event history in KELs, enabling temporal queries and audit trails.
Enterprise Scalability: Multi-valent delegation enables KERI to scale to enterprise and government requirements where thousands or millions of identifiers must be managed within hierarchical organizational structures.
Security Flexibility: Organizations can implement appropriate security measures at each hierarchical level without compromising overall system security—the root can be maximally protected while operational identifiers remain performant.
Organizational Mapping: Digital identity infrastructure can directly mirror organizational structure, simplifying governance, policy enforcement, and operational management.
Fault Isolation: Compromise or failure at lower levels doesn't propagate upward—the root maintains its security properties and can revoke compromised branches.
Operational Efficiency: Workload distribution across multiple delegates enables parallel processing, geographic optimization, and load balancing without architectural constraints.
Audit and Compliance: Complete event history in KELs provides cryptographically verifiable audit trails for regulatory compliance and forensic analysis.
Enterprise Identity Management: Large organizations can implement multi-valent delegation to manage employee identifiers:
Each level implements security appropriate to its role, while the root maintains ultimate control authority and can revoke any branch if compromised.
Supply Chain Management: Multi-valent delegation can model supply chain relationships:
Each delegation creates a verifiable provenance chain for products moving through the supply chain.
Government Services: Hierarchical government structures map naturally to multi-valent delegation:
Citizens can verify the complete delegation chain for any government service, ensuring legitimacy.
IoT Device Management: Internet of Things deployments benefit from multi-valent delegation:
This enables secure device provisioning, firmware updates, and operational management at scale.
Credential Issuance Hierarchies: ACDC credential issuance can leverage multi-valent AID structures:
The vLEI ecosystem exemplifies this pattern, with GLEIF as root, QVIs as delegates, and legal entity credentials issued under delegated authority.
Scalability Without Centralization: Multi-valent delegation enables horizontal scaling through multiple delegates while maintaining decentralized control—no single entity controls the entire hierarchy.
Security Heterogeneity: Different security requirements at different organizational levels can be accommodated within a single coherent architecture.
Operational Flexibility: Organizations can restructure delegation hierarchies as needed—adding, removing, or reorganizing delegates without disrupting the overall system.
Verifiable Governance: Delegation relationships are cryptographically verifiable, enabling automated policy enforcement and compliance verification.
Cost Optimization: High-security infrastructure costs are concentrated at the root level, while operational levels can use more cost-effective implementations.
Disaster Recovery: If operational infrastructure is compromised, the root can revoke affected branches and re-delegate to new infrastructure without losing the root's security properties.
Complexity: Multi-valent delegation introduces architectural complexity—organizations must design and manage delegation hierarchies, which requires careful planning and governance.
Verification Overhead: Verifying a delegation chain requires traversing multiple KELs and validating cryptographic commitments at each level, which increases verification time and computational cost compared to flat structures.
Coordination Requirements: Establishing delegation relationships requires coordination between delegator and delegate—both parties must participate in the cooperative delegation protocol.
Revocation Propagation: Revoking a delegator's authority affects all downstream delegates, which may require careful coordination to avoid operational disruption.
Key Management Burden: Each entity in the delegation tree must maintain its own key management infrastructure, which distributes operational responsibility but also distributes potential points of failure.
Governance Overhead: Multi-level hierarchies require clear governance policies defining delegation authority, revocation procedures, and dispute resolution mechanisms.
Despite these trade-offs, multi-valent delegation provides essential capabilities for enterprise-scale KERI deployments where hierarchical organizational structures must be reflected in digital identity infrastructure while maintaining cryptographic verifiability and decentralized control.
The source documents explicitly position multi-valent delegation as KERI's solution to the security-cost-performance architecture trade-off inherent in key management systems. Traditional approaches force organizations to choose between:
Multi-valent delegation enables organizations to optimize different parts of the hierarchy for different objectives:
This architectural flexibility, combined with the compromise recovery properties of bivalent delegation patterns, enables organizations to achieve security properties at operational levels that would be impossible with flat, non-hierarchical architectures.
The multi-valent pattern thus represents a fundamental architectural innovation in KERI, enabling the protocol to scale from individual use cases to enterprise and government deployments while maintaining its core properties of cryptographic verifiability, decentralized control, and infrastructure independence.