Version: Work in Progress

UNTP Public Review

Public review has now closed. The UNTP team is working through the review comments and expects to release UNTP version 1.0.

Variant-based Disclosure

info

Please note that this specification is suitable for pre-production pilot implementations.

Terminology Note

This guidance describes a variant-based approach where different actors receive different complete documents (Digital Product Passports, Digital Facility Records) based on their access role. This is distinct from cryptographic selective disclosure mechanisms in the W3C Verifiable Credentials ecosystem (such as BBS+ signatures or SD-JWT), which enable selective disclosure within a single credential using cryptographic techniques. The UNTP approach uses Identity Resolver routing rather than cryptographic selective disclosure. Cryptographic selective disclosure is out of v1 conformance; see Disclosing the Data.

This pattern is the variant tool in Disclosing the Data: a different complete, signed credential per role. It is complementary to public discovery and to encryption of the same bytes. Implementers who only need public credentials, or only whole-credential encryption, need not use variants.

Variants that describe the same product or facility share the subject, the issuer, the UNTP credential type, and the id of any claim that is the same assertion in more than one variant. Each copy of that claim id carries the same content. Each variant keeps its own credential id, proof, credentialStatus, validFrom, and validUntil. When the variants are issued together, use the same validity window. Revoking the record means revoking every current variant. Revoking one variant leaves the others in force.

A verifier checks the variant it holds. That check is sufficient. When a claim's content changes, the issuer reissues every current variant that includes that claim id. Variants that omit the claim stay as they are.

Variant-based disclosure extends UNTP Digital Product Passports (DPP) and Digital Facility Records (DFR) so that different actors in the value chain can access different subsets of claims, while maintaining a standards-based approach with minimal complexity. Role names in the examples (Customer, Regulator, Recycler, Auditor) are illustrative. A jurisdiction may define its own audiences — for example the four information-access groups in EU Battery Regulation Article 77 — and implement them as variants. Those audiences are not a UNTP code list.

Challenges

The UNTP Decentralised Access Control specification operates at the entire credential payload level — a party either has access to a credential or they don't. In practice, different actors need access to different claim-level information within the same credential:

Digital Product Passport use cases

Public claims (e.g., recycling instructions) available to all stakeholders
Customer-specific claims (e.g., warranty information) available only to product purchasers
Regulatory claims (e.g., detailed emissions data) available only to competent authorities
Recycler claims (e.g., hazardous material details) available only to accredited recycling facilities

Digital Facility Record use cases

Public claims (e.g., facility location, basic certifications) available to all stakeholders
Customer-specific claims (e.g., capacity, lead times) available only to business partners
Regulatory claims (e.g., worker safety records, environmental compliance) available only to competent authorities
Audit claims (e.g., detailed sustainability metrics) available only to authorized auditors

Design Principles

Minimal Changes: Extend existing structures rather than introduce new patterns
Backwards Compatible: Existing credential verifiers continue to work
Resolver-Discoverable: the Identity Resolver lists every variant with its accessRole; credentials remain static blobs
Discoverability: Users can see what additional data exists and how to access it
Standards-Aligned: Builds on existing UNTP link types and access control patterns
Credential Agnostic: Same pattern works for DPP, DFR, and future UNTP credentials

Conceptual Model

The variant-based disclosure model introduces document variants that enable role-based access to claims while maintaining discoverability through the Identity Resolver.

Architecture Flow

The Identity Resolver returns a linkset listing every document variant, each link carrying an accessRole property that says which roles the variant is intended for
The client selects the variant whose accessRole matches its own role
Each document variant is a complete, valid credential containing:
- Basic claims accessible to the specified role
- Claim stubs (without declaredValue) indicating claims available in other variants
- otherVariants metadata listing other available access roles

Example Variant Structure

Public Variant:

Contains basic claims accessible to all stakeholders
Includes claim stubs for restricted claims (emissions, warranty, hazmat)
Lists other available variants (Customer, Regulator, Recycler)

Regulator Variant:

Contains basic claims plus regulatory-specific claims (emissions data, supply chain provenance)
Includes claim stubs for role-specific claims (warranty for Customers, hazmat for Recyclers)
Lists other available variants for discovery

Key Concepts

Document Variant: A complete, valid credential containing a subset of claims for a specific access role
Claim Stub: A claim entry without declaredValue, indicating the claim exists in another variant
otherVariants: Metadata property listing other available document variants
accessRole: Property on a link (and on claims and variants) indicating which roles the target is intended for. It is metadata, not a query parameter
Identity Resolver: Lists every variant with its accessRole, so a client can find the one meant for it

Requirements

ID	Name	Requirement Statement	Solution Mapping
VD-01	Claim-level granularity	Different actors SHALL be able to access different claims within the same credential based on their role	Multiple document variants with different claims
VD-02	Variant discovery	A credential recipient SHALL be able to discover that other variants exist for different access roles	`otherVariants` property in credential subject
VD-03	Claim discovery	A credential recipient SHALL be able to see which specific claims exist in other variants	Claim stubs in claims array
VD-04	Role-based selection	Identity Resolver linksets SHALL list each document variant with its `accessRole`, so a client can select the variant intended for its role	`accessRole` property on linkset links
VD-05	Credential type agnostic	Solution SHALL work for both DPP and DFR without modification	Generic pattern applicable to any credential with claims
VD-06	Backwards compatibility	Existing credential verifiers MUST continue to function without modification	Extensions are optional; base structures unchanged
VD-07	Minimal complexity	Solution SHALL NOT require cryptographic selective disclosure or complex application logic	Uses static files and Identity Resolver linksets
VD-08	Access indication	Each claim or variant SHALL clearly indicate which access role is required	`accessRole` property on claims and variants

Specification

The following extensions to UNTP credentials, Identity Resolver, and related specifications are defined:

Extension 1: Access Role on Linkset Links

Each link to a document variant in an Identity Resolver linkset SHALL carry an accessRole property listing the roles the variant is intended for. Each value MUST be an absolute URI; UNTP does not define a fixed role list. The resolver returns every variant in the linkset; it does not filter by role. accessRole is not a query parameter.

A client reads the linkset and follows the link whose accessRole matches its own role. Being able to see a link does not mean being able to read its target: a non-public variant is protected by encryption or by access control at the storage location, not by the resolver.

Extension 2: Credential Variant Metadata

Add an optional otherVariants property to the credential subject (ProductPassport or FacilityRecord) to indicate other document variants are available:

{
  "credentialSubject": {
    "type": ["ProductPassport"],
    "id": "https://example.com/products/90664869327",
    "otherVariants": [
      {
        "accessRole": ["https://roles.example/customer"]
      },
      {
        "accessRole": ["https://roles.example/regulator"]
      }
    ],
    "product": {...},
    "conformityClaim": [...]
  }
}

Or for a facility:

{
  "credentialSubject": {
    "type": ["FacilityRecord"],
    "id": "https://example.com/facilities/F123456",
    "otherVariants": [
      {
        "accessRole": ["https://roles.example/customer"]
      },
      {
        "accessRole": ["https://roles.example/auditor"]
      }
    ],
    "facility": {...},
    "conformityClaim": [...]
  }
}

Properties:

otherVariants (OPTIONAL): Array of objects indicating other document variants exist
accessRole (REQUIRED): Array of URIs indicating which role can access the variant

Extension 3: Claim Stubs for Discovery

A claim in the claims array (e.g., conformityClaim, sustainabilityClaim) MAY be a stub indicating the claim exists in another variant but is not included in the current credential.

A claim stub is distinguished by the absence of the declaredValue property combined with the presence of an accessRole property.

{
  "conformityClaim": [
    {
      "id": "https://example.com/claims/emissions-001",
      "conformityTopic": "environment.emissions",
      "description": "Carbon footprint assessment",
      "accessRole": ["https://roles.example/regulator"]
    }
  ]
}

Claim Stub Properties:

id (REQUIRED): Unique identifier for the claim
conformityTopic (REQUIRED): Classification of the claim
description (OPTIONAL): Human-readable description
accessRole (REQUIRED for stubs): Array of URIs indicating required access level
declaredValue (ABSENT): No value data; this is the key indicator it's a stub

Full Claim Properties:

Same as stub, PLUS:

declaredValue (REQUIRED): Array of metric values
accessRole (OPTIONAL): If present, indicates this claim has access restrictions

Implementation Guidance

The following examples demonstrate variant-based disclosure for both Digital Product Passports and Digital Facility Records.

Identity Resolver Behavior

The Identity Resolver behavior is identical for both product and facility identifiers.

Scenario 1: Requesting the Linkset

Request (Product):

GET /01/90664869327
Host: resolver.example.com

Request (Facility):

GET /99/F123456
Host: resolver.example.com

Response (Product):

{
  "linkset": [
    {
      "anchor": "https://resolver.example.com/01/90664869327",
      "dpp": [
        {
          "href": "https://files.example.com/dpp/90664869327-public.json",
          "title": "Digital Product Passport (Public)",
          "type": "application/vc+ld+json",
          "accessRole": ["https://roles.example/public"]
        },
        {
          "href": "https://files.example.com/dpp/90664869327-customer.json",
          "title": "Digital Product Passport (Customer)",
          "type": "application/vc+ld+json",
          "accessRole": ["https://roles.example/customer"]
        },
        {
          "href": "https://files.example.com/dpp/90664869327-regulator.json",
          "title": "Digital Product Passport (Regulator)",
          "type": "application/vc+ld+json",
          "accessRole": ["https://roles.example/regulator"]
        }
      ]
    }
  ]
}

Response (Facility):

{
  "linkset": [
    {
      "anchor": "https://resolver.example.com/99/F123456",
      "https://test.uncefact.org/vocabulary/link-type/dfr": [
        {
          "href": "https://files.example.com/dfr/F123456-public.json",
          "title": "Digital Facility Record (Public)",
          "type": "application/vc+ld+json",
          "accessRole": ["https://roles.example/public"]
        },
        {
          "href": "https://files.example.com/dfr/F123456-customer.json",
          "title": "Digital Facility Record (Customer)",
          "type": "application/vc+ld+json",
          "accessRole": ["https://roles.example/customer"]
        },
        {
          "href": "https://files.example.com/dfr/F123456-auditor.json",
          "title": "Digital Facility Record (Auditor)",
          "type": "application/vc+ld+json",
          "accessRole": ["https://roles.example/auditor"]
        }
      ]
    }
  ]
}

The resolver returns all available variants, so the client can see which access levels exist.

Scenario 2: Selecting a Variant

A customer's system reads the linkset from Scenario 1 and follows the link whose accessRole includes https://roles.example/customer, here https://files.example.com/dpp/90664869327-customer.json. An auditor does the same with the facility linkset and follows https://files.example.com/dfr/F123456-auditor.json. The selection happens in the client. The resolver returns the same linkset to everyone.

Credential Structure Examples

The following examples demonstrate variant-based disclosure for both Digital Product Passports and Digital Facility Records.

Digital Product Passport Examples

Example DPP-1: Public Variant

The public variant contains only claims with accessRole#Anonymous or no access restrictions. It includes:

Full claims for public data
otherVariants array showing other access levels exist
Claim stubs for restricted claims

{
  "@context": [
    "https://www.w3.org/ns/credentials/v2",
    "https://test.uncefact.org/vocabulary/untp/dpp/0.7.0/"
  ],
  "type": ["DigitalProductPassport", "VerifiableCredential"],
  "issuer": {
    "id": "did:web:manufacturer.example.com",
    "name": "Battery Manufacturer Inc"
  },
  "credentialSubject": {
    "type": ["ProductPassport"],
    "id": "https://example.com/products/90664869327",

    "otherVariants": [
      {
        "accessRole": ["https://roles.example/customer"]
      },
      {
        "accessRole": ["https://roles.example/regulator"]
      },
      {
        "accessRole": ["https://roles.example/recycler"]
      }
    ],

    "product": {
      "id": "https://example.com/products/90664869327",
      "name": "Lithium Battery Pack",
      "registeredId": "90664869327",
      "description": "High-capacity lithium battery for electric vehicles"
    },

    "conformityClaim": [
      {
        "id": "https://example.com/claims/recycling-001",
        "conformityTopic": "environment.recycling",
        "description": "Recycling instructions and material composition",
        "declaredValue": [
          {
            "metricName": "Recyclable Content",
            "metricValue": {
              "value": 95,
              "unit": "P1"
            }
          }
        ],
        "conformityEvidence": {
          "type": ["Link"],
          "linkURL": "https://example.com/recycling-instructions.pdf",
          "linkType": "https://test.uncefact.org/vocabulary/link-type/end-of-life-info"
        }
      },
      {
        "id": "https://example.com/claims/emissions-001",
        "conformityTopic": "environment.emissions",
        "description": "Carbon footprint assessment per GBA Rulebook",
        "accessRole": ["https://roles.example/regulator"]
      },
      {
        "id": "https://example.com/claims/warranty-001",
        "conformityTopic": "governance.warranty",
        "description": "Product warranty terms and conditions",
        "accessRole": ["https://roles.example/customer"]
      },
      {
        "id": "https://example.com/claims/hazmat-001",
        "conformityTopic": "environment.hazmat",
        "description": "Hazardous materials declaration for safe recycling",
        "accessRole": ["https://roles.example/recycler"]
      }
    ],

    "circularityScorecard": {
      "recyclableContent": 0.95,
      "recycledContent": 0.3
    }
  }
}

Key Points:

Contains 1 full claim (recycling)
Contains 3 claim stubs (emissions, warranty, hazmat)
otherVariants shows 3 additional access levels exist
Verifiers can display: "Additional information available for Customers, Regulators, and Recyclers"

Example DPP-2: Customer Variant

The customer variant adds warranty information to the public claims:

{
  "@context": [
    "https://www.w3.org/ns/credentials/v2",
    "https://test.uncefact.org/vocabulary/untp/dpp/0.7.0/"
  ],
  "type": ["DigitalProductPassport", "VerifiableCredential"],
  "issuer": {
    "id": "did:web:manufacturer.example.com",
    "name": "Battery Manufacturer Inc"
  },
  "credentialSubject": {
    "type": ["ProductPassport"],
    "id": "https://example.com/products/90664869327",

    "otherVariants": [
      {
        "accessRole": ["https://roles.example/public"]
      },
      {
        "accessRole": ["https://roles.example/regulator"]
      },
      {
        "accessRole": ["https://roles.example/recycler"]
      }
    ],

    "product": {
      "id": "https://example.com/products/90664869327",
      "name": "Lithium Battery Pack",
      "registeredId": "90664869327",
      "description": "High-capacity lithium battery for electric vehicles"
    },

    "conformityClaim": [
      {
        "id": "https://example.com/claims/recycling-001",
        "conformityTopic": "environment.recycling",
        "description": "Recycling instructions and material composition",
        "declaredValue": [
          {
            "metricName": "Recyclable Content",
            "metricValue": {
              "value": 95,
              "unit": "P1"
            }
          }
        ]
      },
      {
        "id": "https://example.com/claims/warranty-001",
        "conformityTopic": "governance.warranty",
        "description": "Product warranty terms and conditions",
        "declaredValue": [
          {
            "metricName": "Warranty Period",
            "metricValue": {
              "value": 5,
              "unit": "ANN"
            }
          },
          {
            "metricName": "Warranty Coverage",
            "metricValue": {
              "value": 100000,
              "unit": "KMT"
            }
          }
        ],
        "conformityEvidence": {
          "type": ["Link"],
          "linkURL": "https://example.com/warranty-certificate.pdf",
          "linkType": "https://test.uncefact.org/vocabulary/link-type/evidence"
        }
      },
      {
        "id": "https://example.com/claims/emissions-001",
        "conformityTopic": "environment.emissions",
        "description": "Carbon footprint assessment per GBA Rulebook",
        "accessRole": ["https://roles.example/regulator"]
      },
      {
        "id": "https://example.com/claims/hazmat-001",
        "conformityTopic": "environment.hazmat",
        "description": "Hazardous materials declaration for safe recycling",
        "accessRole": ["https://roles.example/recycler"]
      }
    ],

    "circularityScorecard": {
      "recyclableContent": 0.95,
      "recycledContent": 0.3
    }
  }
}

Key Points:

Contains 2 full claims (recycling + warranty)
Contains 2 claim stubs (emissions, hazmat)
Customer sees warranty data that public users don't
Still advertises other variants exist

Example DPP-3: Regulator Variant

The regulator variant includes detailed emissions and supply chain data:

{
  "@context": [
    "https://www.w3.org/ns/credentials/v2",
    "https://test.uncefact.org/vocabulary/untp/dpp/0.7.0/"
  ],
  "type": ["DigitalProductPassport", "VerifiableCredential"],
  "issuer": {
    "id": "did:web:manufacturer.example.com",
    "name": "Battery Manufacturer Inc"
  },
  "credentialSubject": {
    "type": ["ProductPassport"],
    "id": "https://example.com/products/90664869327",

    "otherVariants": [
      {
        "accessRole": ["https://roles.example/public"]
      },
      {
        "accessRole": ["https://roles.example/customer"]
      },
      {
        "accessRole": ["https://roles.example/recycler"]
      }
    ],

    "product": {
      "id": "https://example.com/products/90664869327",
      "name": "Lithium Battery Pack",
      "registeredId": "90664869327",
      "description": "High-capacity lithium battery for electric vehicles"
    },

    "conformityClaim": [
      {
        "id": "https://example.com/claims/recycling-001",
        "conformityTopic": "environment.recycling",
        "description": "Recycling instructions and material composition",
        "declaredValue": [
          {
            "metricName": "Recyclable Content",
            "metricValue": {
              "value": 95,
              "unit": "P1"
            }
          }
        ]
      },
      {
        "id": "https://example.com/claims/emissions-001",
        "conformityTopic": "environment.emissions",
        "description": "Carbon footprint assessment per GBA Rulebook",
        "referenceStandard": {
          "type": ["Standard"],
          "id": "https://www.globalbattery.org/media/publications/gba-rulebook-v2.0-master.pdf",
          "name": "GBA Battery Passport Greenhouse Gas Rulebook - V.2.0"
        },
        "declaredValue": [
          {
            "metricName": "GHG Emissions Intensity",
            "metricValue": {
              "value": 12.5,
              "unit": "KGM"
            },
            "accuracy": 0.05
          }
        ],
        "conformityEvidence": {
          "type": ["SecureLink", "Link"],
          "linkURL": "https://example.com/evidence/emissions-attestation.json",
          "linkType": "https://test.uncefact.org/vocabulary/link-type/dcc",
          "hashDigest": "6239119dda5bd4c8a6ffb832fe16feaa5c27b7dba154d24c53d4470a2c69adc2",
          "hashMethod": "SHA-256"
        }
      },
      {
        "id": "https://example.com/claims/provenance-001",
        "conformityTopic": "materials.provenance",
        "description": "Supply chain due diligence and material origins",
        "declaredValue": [
          {
            "metricName": "Primary Sourced Data Ratio",
            "metricValue": {
              "value": 0.85,
              "unit": "P1"
            }
          }
        ]
      },
      {
        "id": "https://example.com/claims/warranty-001",
        "conformityTopic": "governance.warranty",
        "description": "Product warranty terms and conditions",
        "accessRole": ["https://roles.example/customer"]
      },
      {
        "id": "https://example.com/claims/hazmat-001",
        "conformityTopic": "environment.hazmat",
        "description": "Hazardous materials declaration for safe recycling",
        "accessRole": ["https://roles.example/recycler"]
      }
    ],

    "emissionsScorecard": {
      "carbonFootprint": 12.5,
      "declaredUnit": "KGM",
      "operationalScope": "CradleToGate",
      "primarySourcedRatio": 0.85
    },

    "circularityScorecard": {
      "recyclableContent": 0.95,
      "recycledContent": 0.3
    }
  }
}

Key Points:

Contains 3 full claims (recycling + emissions + provenance)
Contains 2 claim stubs (warranty, hazmat)
Includes detailed emissions scorecard
Regulators see supply chain data that others don't

Digital Facility Record Examples

Example DFR-1: Public Variant

The public variant contains basic facility information available to all stakeholders:

{
  "@context": [
    "https://www.w3.org/ns/credentials/v2",
    "https://test.uncefact.org/vocabulary/untp/dfr/0.7.0/"
  ],
  "type": ["DigitalFacilityRecord", "VerifiableCredential"],
  "issuer": {
    "id": "did:web:facility.example.com",
    "name": "Battery Manufacturing Facility"
  },
  "credentialSubject": {
    "type": ["FacilityRecord"],
    "id": "https://example.com/facilities/F123456",

    "otherVariants": [
      {
        "accessRole": ["https://roles.example/customer"]
      },
      {
        "accessRole": ["https://roles.example/auditor"]
      },
      {
        "accessRole": ["https://roles.example/regulator"]
      }
    ],

    "facility": {
      "id": "https://example.com/facilities/F123456",
      "name": "Battery Cell Manufacturing Plant",
      "registeredId": "F123456",
      "description": "High-capacity lithium battery cell production facility",
      "location": {
        "address": "123 Industrial Blvd, Manufacturing District",
        "countryCode": "CN",
        "geoCoordinates": {
          "latitude": 31.2304,
          "longitude": 121.4737
        }
      },
      "operatedBy": {
        "id": "https://business.gov.cn/12345678",
        "name": "Battery Manufacturer Inc"
      }
    },

    "conformityClaim": [
      {
        "id": "https://example.com/facilities/F123456/claims/iso-14001",
        "conformityTopic": "environment.management",
        "description": "ISO 14001 Environmental Management certification",
        "declaredValue": [
          {
            "metricName": "Certification Status",
            "metricValue": {
              "value": "Active",
              "unit": "text"
            }
          }
        ],
        "conformityEvidence": {
          "type": ["Link"],
          "linkURL": "https://example.com/certs/iso-14001.pdf",
          "linkType": "https://test.uncefact.org/vocabulary/link-type/evidence"
        }
      },
      {
        "id": "https://example.com/facilities/F123456/claims/capacity",
        "conformityTopic": "production.capacity",
        "description": "Annual production capacity and lead times",
        "accessRole": ["https://roles.example/customer"]
      },
      {
        "id": "https://example.com/facilities/F123456/claims/safety",
        "conformityTopic": "governance.safety",
        "description": "Worker safety records and incident reports",
        "accessRole": ["https://roles.example/regulator"]
      },
      {
        "id": "https://example.com/facilities/F123456/claims/sustainability",
        "conformityTopic": "environment.sustainability",
        "description": "Detailed sustainability metrics and targets",
        "accessRole": ["https://roles.example/auditor"]
      }
    ]
  }
}

Key Points:

Contains 1 full claim (ISO 14001 certification)
Contains 3 claim stubs (capacity, safety, sustainability)
otherVariants shows 3 additional access levels exist
Public can see location and basic certifications
Facility contact information available to all

Example DFR-2: Customer Variant

The customer variant adds business-relevant operational information:

{
  "@context": [
    "https://www.w3.org/ns/credentials/v2",
    "https://test.uncefact.org/vocabulary/untp/dfr/0.7.0/"
  ],
  "type": ["DigitalFacilityRecord", "VerifiableCredential"],
  "issuer": {
    "id": "did:web:facility.example.com",
    "name": "Battery Manufacturing Facility"
  },
  "credentialSubject": {
    "type": ["FacilityRecord"],
    "id": "https://example.com/facilities/F123456",

    "otherVariants": [
      {
        "accessRole": ["https://roles.example/public"]
      },
      {
        "accessRole": ["https://roles.example/auditor"]
      },
      {
        "accessRole": ["https://roles.example/regulator"]
      }
    ],
    "facility": {
      "id": "https://example.com/facilities/F123456",
      "name": "Battery Cell Manufacturing Plant",
      "registeredId": "F123456",
      "description": "High-capacity lithium battery cell production facility",
      "location": {
        "address": "123 Industrial Blvd, Manufacturing District",
        "countryCode": "CN",
        "geoCoordinates": {
          "latitude": 31.2304,
          "longitude": 121.4737
        }
      }
    },
    "conformityClaim": [
      {
        "id": "https://example.com/facilities/F123456/claims/iso-14001",
        "conformityTopic": "environment.management",
        "description": "ISO 14001 Environmental Management certification",
        "declaredValue": [
          {
            "metricName": "Certification Status",
            "metricValue": {
              "value": "Active",
              "unit": "text"
            }
          }
        ]
      },
      {
        "id": "https://example.com/facilities/F123456/claims/capacity",
        "conformityTopic": "production.capacity",
        "description": "Annual production capacity and lead times",
        "declaredValue": [
          {
            "metricName": "Annual Capacity",
            "metricValue": {
              "value": 5000000,
              "unit": "H87"
            }
          },
          {
            "metricName": "Lead Time",
            "metricValue": {
              "value": 12,
              "unit": "WEE"
            }
          },
          {
            "metricName": "Utilization Rate",
            "metricValue": {
              "value": 85,
              "unit": "P1"
            }
          }
        ]
      },
      {
        "id": "https://example.com/facilities/F123456/claims/safety",
        "conformityTopic": "governance.safety",
        "description": "Worker safety records and incident reports",
        "accessRole": ["https://roles.example/regulator"]
      },
      {
        "id": "https://example.com/facilities/F123456/claims/sustainability",
        "conformityTopic": "environment.sustainability",
        "description": "Detailed sustainability metrics and targets",
        "accessRole": ["https://roles.example/auditor"]
      }
    ]
  }
}

Key Points:

Contains 2 full claims (ISO cert + production capacity)
Contains 2 claim stubs (safety, sustainability)
Customers see operational data for supply chain planning
Production capacity and lead times support procurement decisions

Example DFR-3: Auditor Variant

The auditor variant includes comprehensive sustainability data:

{
  "@context": [
    "https://www.w3.org/ns/credentials/v2",
    "https://test.uncefact.org/vocabulary/untp/dfr/0.7.0/"
  ],
  "type": ["DigitalFacilityRecord", "VerifiableCredential"],
  "issuer": {
    "id": "did:web:facility.example.com",
    "name": "Battery Manufacturing Facility"
  },
  "credentialSubject": {
    "type": ["FacilityRecord"],
    "id": "https://example.com/facilities/F123456",

    "otherVariants": [
      {
        "accessRole": ["https://roles.example/public"]
      },
      {
        "accessRole": ["https://roles.example/customer"]
      },
      {
        "accessRole": ["https://roles.example/regulator"]
      }
    ],

    "facility": {
      "id": "https://example.com/facilities/F123456",
      "name": "Battery Cell Manufacturing Plant",
      "registeredId": "F123456",
      "description": "High-capacity lithium battery cell production facility",
      "location": {
        "address": "123 Industrial Blvd, Manufacturing District",
        "countryCode": "CN",
        "geoCoordinates": {
          "latitude": 31.2304,
          "longitude": 121.4737
        }
      }
    },

    "conformityClaim": [
      {
        "id": "https://example.com/facilities/F123456/claims/iso-14001",
        "conformityTopic": "environment.management",
        "description": "ISO 14001 Environmental Management certification",
        "declaredValue": [
          {
            "metricName": "Certification Status",
            "metricValue": {
              "value": "Active",
              "unit": "text"
            }
          }
        ]
      },
      {
        "id": "https://example.com/facilities/F123456/claims/sustainability",
        "conformityTopic": "environment.sustainability",
        "description": "Detailed sustainability metrics and targets",
        "referenceStandard": {
          "type": ["Standard"],
          "id": "https://www.iso.org/standard/70453.html",
          "name": "ISO 14064-1:2018 Greenhouse gases"
        },
        "declaredValue": [
          {
            "metricName": "Scope 1 Emissions",
            "metricValue": {
              "value": 2500,
              "unit": "TNE"
            }
          },
          {
            "metricName": "Scope 2 Emissions",
            "metricValue": {
              "value": 15000,
              "unit": "TNE"
            }
          },
          {
            "metricName": "Renewable Energy Use",
            "metricValue": {
              "value": 45,
              "unit": "P1"
            }
          },
          {
            "metricName": "Water Consumption",
            "metricValue": {
              "value": 500000,
              "unit": "LTR"
            }
          }
        ],
        "conformityEvidence": {
          "type": ["SecureLink", "Link"],
          "linkURL": "https://example.com/evidence/sustainability-audit.json",
          "linkType": "https://test.uncefact.org/vocabulary/link-type/dcc"
        }
      },
      {
        "id": "https://example.com/facilities/F123456/claims/capacity",
        "conformityTopic": "production.capacity",
        "description": "Annual production capacity and lead times",
        "accessRole": ["https://roles.example/customer"]
      },
      {
        "id": "https://example.com/facilities/F123456/claims/safety",
        "conformityTopic": "governance.safety",
        "description": "Worker safety records and incident reports",
        "accessRole": ["https://roles.example/regulator"]
      }
    ]
  }
}

Key Points:

Contains 2 full claims (ISO cert + sustainability metrics)
Contains 2 claim stubs (capacity, safety)
Auditors see detailed environmental performance data
Includes GHG emissions, renewable energy use, water consumption
Links to third-party audit evidence

Claim Reference Extension (Optional)

For cases where a claim needs to point to additional detailed evidence with its own access control:

{
  "conformityClaim": [
    {
      "id": "https://example.com/claims/emissions-001",
      "conformityTopic": "environment.emissions",
      "description": "Carbon footprint summary",
      "declaredValue": [
        {
          "metricName": "GHG Emissions Intensity",
          "metricValue": {
            "value": 12.5,
            "unit": "KGM"
          }
        }
      ],
      "conformityEvidence": {
        "type": ["SecureLink", "Link"],
        "linkURL": "https://example.com/evidence/emissions-detailed.json",
        "linkType": "https://test.uncefact.org/vocabulary/link-type/dcc",
        "accessRole": ["https://roles.example/regulator"]
      }
    }
  ]
}

This allows a claim to include:

Summary data (inline declaredValue)
Reference to detailed evidence (via conformityEvidence with accessRole)

Implementation Considerations

Variant Generation Strategy

Implementers have flexibility in how they generate and store variants for both DPPs and DFRs:

Option A: Pre-compute all variants at issuance

Generate public, customer, regulator, auditor variants as appropriate
Store as separate static files
Fast retrieval, more storage
Best for high-traffic credentials

Option B: Dynamic variant generation

Store one "full" credential with all claims
Generate each variant when its URL is requested
Less storage, more compute
Best for low-traffic or frequently updated credentials

Option C: Hybrid

Pre-compute common variants (public, customer)
Generate rare variants on-demand (auditor, inspector)
Balance storage and compute costs

Resolver Implementation

The Identity Resolver needs minimal changes:

Maintain mapping of identifier → available variants
Include an accessRole property on each variant link in the linkset

No authentication required at resolver level; access control can be enforced at storage level via encryption or authentication.

Storage Patterns

Document variants can be stored in any web-accessible location:

Digital Product Passport storage example:

https://files.example.com/dpp/90664869327-public.json
https://files.example.com/dpp/90664869327-customer.json
https://files.example.com/dpp/90664869327-regulator.json
https://files.example.com/dpp/90664869327-recycler.json

Digital Facility Record storage example:

https://files.example.com/dfr/F123456-public.json
https://files.example.com/dfr/F123456-customer.json
https://files.example.com/dfr/F123456-auditor.json
https://files.example.com/dfr/F123456-regulator.json

Or with encryption for sensitive variants:

https://files.example.com/dpp/90664869327-public.json (unencrypted)
https://files.example.com/dpp/90664869327-customer.json.enc (encrypted, key in package)
https://files.example.com/dpp/90664869327-regulator.json (requires DID auth at CDN)

Security Considerations

Claim Stub Information Leakage

Claim stubs reveal that certain data exists without revealing the data itself. This is intentional for discoverability but implementers should consider:

Which claims to include as stubs in public variants
Whether to include description field (may reveal too much)
Option to omit stubs entirely (no hints about restricted data)

Access Role Verification

This proposal does not specify HOW to verify that a requestor has a claimed access role. Implementers can use:

No verification: Public variants are truly public
Shared secrets: Key in product packaging (current UNTP pattern)
DID Authentication: Prove DID ownership and check against whitelist
Digital Identity Anchor: Present credential proving authorized role

These mechanisms are complementary and can be combined per use case.

Relation to Other Specifications

Decentralised Access Control

Variant-based disclosure is complementary to Decentralised Access Control; it does not require it. See Disclosing the Data.

DAC encrypts the same bytes and distributes keys (optional for conformance)
Variant-based disclosure issues a different complete, signed credential per role
Both can be used together (encrypted variants with claim stubs)

Identity Resolver

Variant-based disclosure extends the Identity Resolver specification:

Adds accessRole property to links in linkset responses
Maintains existing linkset structure
Works with product identifiers (01), facility identifiers (99), and future identifier types

Digital Product Passport

Variant-based disclosure extends the Digital Product Passport specification:

Adds optional otherVariants property to ProductPassport
Adds optional accessRole property to claims
Defines claim stub pattern (no declaredValue)
Maintains existing DPP structure

Digital Facility Record

Variant-based disclosure extends the Digital Facility Record specification:

Adds optional otherVariants property to FacilityRecord
Adds optional accessRole property to claims
Defines claim stub pattern (no declaredValue)
Maintains existing DFR structure

Conformance

Implementations claiming conformance to variant-based disclosure MUST:

Include accessRole on every variant link in Identity Resolver linksets
Correctly interpret otherVariants property when present in credentials
Correctly interpret claim stubs (claims without declaredValue property)

Implementations MAY:

Support all defined access roles or a subset based on use case requirements
Implement pre-computed variants, dynamic filtering, or hybrid approaches
Add additional properties to variant metadata for implementation-specific needs

Appendix A: Complete Example Linksets

Example Linkset for Digital Product Passport

Example Identity Resolver response for product with multiple variants:

{
  "linkset": [
    {
      "anchor": "https://resolver.example.com/01/90664869327",

      "dpp": [
        {
          "href": "https://files.example.com/dpp/90664869327-public.json",
          "title": "Digital Product Passport (Public)",
          "type": "application/vc+ld+json",
          "accessRole": ["https://roles.example/public"]
        },
        {
          "href": "https://files.example.com/dpp/90664869327-customer.json",
          "title": "Digital Product Passport (Customer)",
          "type": "application/vc+ld+json",
          "accessRole": ["https://roles.example/customer"]
        },
        {
          "href": "https://files.example.com/dpp/90664869327-regulator.json",
          "title": "Digital Product Passport (Regulator)",
          "type": "application/vc+ld+json",
          "accessRole": ["https://roles.example/regulator"]
        },
        {
          "href": "https://files.example.com/dpp/90664869327-recycler.json",
          "title": "Digital Product Passport (Recycler)",
          "type": "application/vc+ld+json",
          "accessRole": ["https://roles.example/recycler"]
        }
      ],

      "https://test.uncefact.org/vocabulary/link-type/dcc": [
        {
          "href": "https://files.example.com/certs/gba-compliance.json",
          "title": "GBA Battery Rulebook Compliance Certificate",
          "type": "application/vc+ld+json"
        }
      ]
    }
  ]
}

Example Linkset for Digital Facility Record

Example Identity Resolver response for facility with multiple variants:

{
  "linkset": [
    {
      "anchor": "https://resolver.example.com/99/F123456",
      "https://test.uncefact.org/vocabulary/link-type/dfr": [
        {
          "href": "https://files.example.com/dfr/F123456-public.json",
          "title": "Digital Facility Record (Public)",
          "type": "application/vc+ld+json",
          "accessRole": ["https://roles.example/public"]
        },
        {
          "href": "https://files.example.com/dfr/F123456-customer.json",
          "title": "Digital Facility Record (Customer)",
          "type": "application/vc+ld+json",
          "accessRole": ["https://roles.example/customer"]
        },
        {
          "href": "https://files.example.com/dfr/F123456-auditor.json",
          "title": "Digital Facility Record (Auditor)",
          "type": "application/vc+ld+json",
          "accessRole": ["https://roles.example/auditor"]
        },
        {
          "href": "https://files.example.com/dfr/F123456-regulator.json",
          "title": "Digital Facility Record (Regulator)",
          "type": "application/vc+ld+json",
          "accessRole": ["https://roles.example/regulator"]
        }
      ],

      "https://test.uncefact.org/vocabulary/link-type/dcc": [
        {
          "href": "https://files.example.com/certs/iso-14001.json",
          "title": "ISO 14001 Environmental Management Certification",
          "type": "application/vc+ld+json"
        }
      ]
    }
  ]
}

Challenges​

Digital Product Passport use cases​

Digital Facility Record use cases​

Design Principles​

Conceptual Model​

Architecture Flow​

Example Variant Structure​

Key Concepts​

Requirements​

Specification​

Extension 1: Access Role on Linkset Links​

Extension 2: Credential Variant Metadata​

Extension 3: Claim Stubs for Discovery​

Implementation Guidance​

Identity Resolver Behavior​

Scenario 1: Requesting the Linkset​

Scenario 2: Selecting a Variant​

Credential Structure Examples​

Digital Product Passport Examples​

Example DPP-1: Public Variant​

Example DPP-2: Customer Variant​

Example DPP-3: Regulator Variant​

Digital Facility Record Examples​

Example DFR-1: Public Variant​

Example DFR-2: Customer Variant​

Example DFR-3: Auditor Variant​

Claim Reference Extension (Optional)​

Implementation Considerations​

Variant Generation Strategy​

Resolver Implementation​

Storage Patterns​

Security Considerations​

Claim Stub Information Leakage​

Access Role Verification​

Relation to Other Specifications​

Decentralised Access Control​

Identity Resolver​

Digital Product Passport​

Digital Facility Record​

Conformance​

Appendix A: Complete Example Linksets​

Example Linkset for Digital Product Passport​

Example Linkset for Digital Facility Record​

Challenges

Digital Product Passport use cases

Digital Facility Record use cases

Design Principles

Conceptual Model

Architecture Flow

Example Variant Structure

Key Concepts

Requirements

Specification

Extension 1: Access Role on Linkset Links

Extension 2: Credential Variant Metadata

Extension 3: Claim Stubs for Discovery

Implementation Guidance

Identity Resolver Behavior

Scenario 1: Requesting the Linkset

Scenario 2: Selecting a Variant

Credential Structure Examples

Digital Product Passport Examples

Example DPP-1: Public Variant

Example DPP-2: Customer Variant

Example DPP-3: Regulator Variant

Digital Facility Record Examples

Example DFR-1: Public Variant

Example DFR-2: Customer Variant

Example DFR-3: Auditor Variant

Claim Reference Extension (Optional)

Implementation Considerations

Variant Generation Strategy

Resolver Implementation

Storage Patterns

Security Considerations

Claim Stub Information Leakage

Access Role Verification

Relation to Other Specifications

Decentralised Access Control

Identity Resolver

Digital Product Passport

Digital Facility Record

Conformance

Appendix A: Complete Example Linksets

Example Linkset for Digital Product Passport

Example Linkset for Digital Facility Record