AL2 — Verified
AL2 requires verification by a registered Attestation Authority (AAA), with manual review of domain-specific criteria.
Criteria
| Criterion | Requirement |
|---|---|
| All AL1 Criteria Met | All automated checks from AL1 pass, now verified by the AAA rather than self-checked |
| Manual Domain Review | Domain Working Group conducts manual review of domain-specific certification criteria — test cases from relevant domain profile executed with auditor oversight |
| Cryptographic Provenance Chain | Entity demonstrates a complete cryptographic provenance chain for sample content — every record's Ed25519 signature verified against resolved agent DID public key |
| Policy Enforcement Testing | Policy enforcement rules tested against reference agent behavior — consent propagation, redaction accuracy, and permission checks validated across ≥ 3 agent hops |
| Attestation Certificate | AAA issues attestation certificate with digital signature, linking to Registry entry via ATR record ID |
Badge Issued
Per-domain badges: [DOMAIN]-AL2 (e.g., TRNS-AL2 — "Verified by [AAA Name]")
Guarantee
The entity's identity has been verified by a registered AAA with manual domain review. Its provenance chain is cryptographically intact and its policy enforcement rules produce consistent results across independent implementations.
Verification Method
AAA executes automated checks, conducts manual document review, verifies cryptographic signatures on sample content, tests policy enforcement against reference agents, issues signed attestation certificate filed in Registry.