Loading vLEI.wiki
Fetching knowledge base...
Fetching knowledge base...
This comprehensive explanation has been generated from 175 GitHub source documents. All source documents are searchable here.
Last updated: October 7, 2025
This content is meant to be consumed by AI agents via MCP. Click here to get the MCP configuration.
Note: In rare cases it may contain LLM hallucinations.
For authoritative documentation, please consult the official GLEIF vLEI trainings and the ToIP Glossary.
An Official Organizational Role (OOR) is a person who represents a Legal Entity in an official organizational capacity and is issued an OOR vLEI Credential to cryptographically verify their formal position within the organization's governance structure.
An Official Organizational Role (OOR) is defined in the GLEIF vLEI Ecosystem Governance Framework as "a person that represents the Legal Entity in an official organizational role and is issued an OOR vLEI Credential." The official abbreviation is OOR, and this term is consistently capitalized in First Letter Capitals throughout the vLEI governance documentation.
The OOR represents a formal, permanent organizational position within a Legal Entity's governance structure, distinguishing it from functional or engagement-based roles. Examples of OOR positions include Chief Executive Officer (CEO), Chief Financial Officer (CFO), Board Directors, and other officially designated organizational positions that carry formal authority within the entity's legal and operational framework.
The OOR concept sits at Tier 4 of the vLEI credential hierarchy, which establishes a chain of trust from GLEIF down to individual role holders:
The OOR credential enables Legal Entities to cryptographically bind individuals to their official organizational positions, creating verifiable proof of authority that can be presented to third parties without requiring real-time verification with the Legal Entity itself.
Multi-Signature Coordination: Organizations with multiple LARs must implement workflows for coordinating multi-signature authorization of QVI OOR AUTH credentials. This requires:
Identity Assurance Procedures: Implementing IAL2-compliant identity verification requires:
Credential Lifecycle Management: Organizations must establish processes for:
Privacy and Data Protection: OOR credential implementations must address:
Interoperability: To ensure broad acceptance of OOR credentials:
GLEIF (Global Legal Entity Identifier Foundation) governs the vLEI ecosystem through the vLEI Ecosystem Governance Framework v3.0, which establishes comprehensive policies for OOR credentials. GLEIF's role includes:
The OOR credential framework operates under GLEIF's authority as the governing body of the Global LEI System (GLEIS), extending the traditional LEI framework into verifiable digital credentials.
The OOR concept interacts with several key governance entities:
Legal Entity Authorized Representatives (LARs): Individuals authorized by the Legal Entity to request OOR credential issuance. LARs perform initial identity assurance and create QVI OOR AUTH vLEI Credentials that authorize QVIs to issue OOR credentials to specific individuals.
QVI Authorized Representatives (QARs): Representatives of Qualified vLEI Issuers who conduct additional identity verification and issue the final OOR credentials to individuals.
Designated Authorized Representatives (DARs): Legal Entity representatives who authorize LARs and manage the Legal Entity's participation in the vLEI ecosystem.
OOR Persons: The individuals who receive and hold OOR vLEI Credentials, representing the Legal Entity in their official organizational capacity.
An OOR Person holding an OOR vLEI Credential has several key responsibilities:
Representation Authority: The OOR Person is authorized to represent the Legal Entity in their official capacity as defined by the credential. This representation is cryptographically verifiable through the KERI infrastructure, enabling third parties to confirm the person's authority without contacting the Legal Entity.
Credential Management: The OOR Person must maintain control over their Autonomic Identifier (AID) and associated cryptographic keys. This includes:
Identity Verification Compliance: OOR Persons must undergo rigorous identity verification processes that meet NIST 800-63A Identity Assurance Level 2 (IAL2) standards or equivalent digital identity credentials from approved schemes.
Credential Presentation: When acting in their official capacity, OOR Persons present their credentials to verifiers using the IPEX (Issuance and Presentation Exchange) protocol, enabling cryptographic verification of their role and authority.
The OOR credential grants specific authorities:
Official Representation: The credential provides cryptographic proof that the holder is authorized to act in an official organizational capacity. This enables:
Credential Chaining: OOR credentials can serve as the basis for issuing additional credentials. For example, an OOR Person might authorize the issuance of Engagement Context Role (ECR) credentials to individuals working on specific projects.
Multi-Signature Participation: In organizations with multiple OOR Persons, credentials may require multi-signature authorization for certain actions, implementing governance policies through cryptographic thresholds.
The OOR credential has specific limitations:
Scope Restriction: The credential only verifies the person's official organizational role. It does not:
Revocation Dependency: The credential's validity depends on:
Context Specificity: OOR credentials are designed for official organizational roles only. They are not appropriate for:
The OOR credential issuance process varies based on Legal Entity structure:
For Legal Entities with multiple authorized signers:
Phase 1: LAR Authorization
Phase 2: QVI Issuance
For Legal Entities with a single employee:
Verifiers validate OOR credentials through multiple mechanisms:
Cryptographic Verification:
Status Verification:
Authorization Chain Verification:
Challenge-Response Authentication:
OOR credentials may be revoked under several conditions:
Legal Entity Initiated Revocation:
QVI Initiated Revocation:
GLEIF Initiated Revocation:
Automatic Revocation Triggers:
Revocation is recorded in the credential's TEL, which is anchored to the issuer's Key Event Log (KEL), creating an immutable audit trail.
The OOR vLEI Credential is implemented as an Authentic Chained Data Container (ACDC) with the schema SAID EBNaNu-M9P5cgrnfl2Fvymy4E_jvxxyjb70PRtiANlJy at version 1.0.0.
Top-Level Fields:
v: Version string for ACDC protocol complianced: Credential SAID providing cryptographic bindingu: One-time-use nonce for privacy protectioni: QVI Issuer AIDri: Credential status registry identifier (TEL reference)s: Schema SAIDa: Attributes block (can be compact SAID or full disclosure)e: Edges block (authorization chain)r: Rules block (legal disclaimers)Attributes Block:
i: OOR Person's AIDdt: Issuance datetime (ISO 8601 format)LEI: Legal Entity IdentifierpersonLegalName: Full legal name from identity verificationofficialRole: Specific organizational position (e.g., "Chief Executive Officer")Edges Block:
auth: Reference to QVI OOR AUTH vLEI Credential
n: SAID of the authorization credentials: Required schema SAID (EKA57bKBKxr_kN7iN5i7lMUxpMG-s19dRcmov1iDxz-E)o: Operator type I2I (Issuer-to-Issuer delegation)The OOR credential leverages KERI's core infrastructure:
Autonomic Identifiers (AIDs): Each participant (Legal Entity, QVI, OOR Person) maintains their own AID with associated Key Event Log (KEL) tracking all key management events.
Key Pre-Rotation: KERI's pre-rotation mechanism provides post-quantum security by committing to next keys before current keys are exposed.
Witness Networks: Witnesses provide duplicity detection and high availability for KELs, ensuring the integrity of the credential chain.
Transaction Event Logs (TELs): Credential issuance and revocation events are recorded in TELs anchored to the issuer's KEL, creating verifiable audit trails.
Out-Of-Band Introductions (OOBIs): Discovery and verification of AIDs occurs through OOBI resolution, enabling secure communication channel establishment.
OOR credentials support graduated disclosure patterns:
Compact Disclosure: Present only the credential SAID and edges block, revealing minimal information while maintaining verifiability.
Partial Disclosure: Reveal specific attributes (e.g., LEI and officialRole) while keeping personLegalName private.
Full Disclosure: Reveal all credential attributes for complete verification.
This flexibility enables privacy-preserving credential presentations where only necessary information is disclosed for a given transaction.
Legal Entity Official Organizational Role vLEI Credential Framework v1.4 (2025-04-16): The authoritative governance document defining all requirements for OOR credentials, including:
vLEI Ecosystem Governance Framework v3.0 Primary Document (2023-08-30): Establishes the overall governance structure, stakeholder roles, and core policies applicable to all vLEI credentials.
vLEI Ecosystem Governance Framework v3.0 Glossary v1.3 (2023-12-15): Provides authoritative definitions for all terms used in the vLEI ecosystem, including OOR and related concepts.
vLEI Ecosystem Governance Framework v3.0 Trust Assurance Framework v1.5 (2025-04-16): Defines trust assurance requirements, risk assessments, and compliance obligations for all vLEI ecosystem participants.
vLEI Ecosystem Governance Framework v3.0 Information Trust Policies v1.2 (2025-04-16): Establishes security, privacy, availability, and confidentiality policies governing all vLEI operations.
Qualified vLEI Issuer Authorization vLEI Credential Framework v1.3 (2025-04-16): Defines the authorization credentials (QVI OOR AUTH) that enable OOR credential issuance.
vLEI Credential Schema Registry v1.1 (2023-12-15): Maintains the official JSON Schema definitions for all vLEI credential types, including the OOR credential schema.
KERI (Key Event Receipt Infrastructure) Specification: The foundational protocol specification defining AIDs, KELs, witnesses, and other core infrastructure used by OOR credentials.
ACDC (Authentic Chained Data Containers) Specification: Defines the credential structure, chaining mechanisms, and disclosure patterns used by OOR credentials.
IPEX (Issuance and Presentation Exchange) Specification: Defines the protocol for issuing and presenting OOR credentials between parties.
vLEI Issuer Qualification Agreement: The contractual agreement between GLEIF and QVIs that establishes qualification requirements and operational obligations.
vLEI Issuer Qualification Program Checklist: Detailed checklist of requirements that QVIs must satisfy to qualify for issuing OOR credentials.
Legal Entity vLEI Credential Framework: Defines the prerequisite Legal Entity credential that must exist before OOR credentials can be issued.
It is critical to distinguish OOR credentials from Engagement Context Role (ECR) credentials:
OOR Credentials are for:
ECR Credentials are for:
The governance frameworks for these credential types differ significantly in their identity assurance requirements, issuance procedures, and intended use cases.
The OOR credential provides several key benefits to the vLEI ecosystem:
Cryptographic Verification: Third parties can verify an individual's official organizational role without contacting the Legal Entity, reducing friction in business transactions.
Fraud Prevention: The cryptographic binding between the person, their AID, and their organizational role makes impersonation extremely difficult.
Regulatory Compliance: OOR credentials enable automated compliance checking for regulatory filings and other official submissions.
Audit Trail: The complete credential lifecycle is recorded in immutable KELs and TELs, providing comprehensive audit trails for governance and compliance purposes.
Interoperability: The standardized ACDC structure and KERI infrastructure enable OOR credentials to be verified across different systems and jurisdictions without requiring proprietary integration.
Privacy Preservation: Graduated disclosure mechanisms allow OOR Persons to reveal only necessary information for each transaction, protecting privacy while maintaining verifiability.