DIGITAL IDENTITY CONTEXT: A CRITERION FOR CONTEXT DELINEATION UNDER NIST SP 800-63-4

NIST SP 800-63-4 revises the definition of digital identity (DI). Rather than describing it as the unique representation of a subject engaged in an online transaction, the revised definition refers to an attribute or set of attributes that uniquely describes a subject within a given context. At the same time, the Digital Identity Risk Management (DIRM) framework relates Identity Assurance Level (IAL), Authentication Assurance Level (AAL), and Federation Assurance Level (FAL) requirements to the potential impacts associated with an online service, its functions, transactions, and user privileges. Yet the guidelines do not prescribe an explicit rule for deciding when changes in risk warrant the delineation of a distinct DI context. This paper proposes a prescriptive architectural principle: where the risk assessment for a particular class of transactions establishes a need to raise at least one of IAL, AAL, or FAL relative to the original context, the architect SHALL delineate, define, and document a distinct digital identity context. This criterion does not change the requirements of NIST SP 800-63-4. Instead, it introduces a rule for identifying digital identity context boundaries by applying the risk-based assessment and assurance-level requirements already provided by the guidelines. It is an author-proposed rule for architectural decomposition, not an existing NIST requirement. Delineating a context does not, in itself, entail creating another subscriber account or physical data store, or repeating identity proofing. Keywords: digital identity, context, NIST SP 800-63-4, DIRM, IAL, AAL, FAL, identity federation, risk-based identity architecture.