Applications / Partner Access
One organization can establish something another relies on without making the decision for them.
Organizations routinely need to make decisions about people whose primary relationship sits somewhere else.
One organization may already have established someone's relationship with it and the authority or facts relevant to what they need to do. Another organization still has its own responsibilities and requirements governing access to its resources.
For the receiving organization, the decision is:
The decision
Is what has been established elsewhere enough to allow this person to access this resource here?
Krutho can allow that access decision to rely on what the other organization established without requiring it to participate every time the decision is made.
Relevant evidence can cross the organizational boundary while the receiving organization retains responsibility for its own decision.
Authority can cross a boundary without decision responsibility crossing with it.
What one organization establishes does not decide for the other.
Suppose a person presents evidence of their relationship with Organization A when requesting access to a resource controlled by Organization B.
B must decide whether to permit that access.
What A has established may be relevant to the access decision. It does not determine it. B still determines what it trusts, what evidence it requires, whether that evidence is sufficient, what state needs to be available and what should result, under the conditions governing its decision, including any it has agreed with A.
A does not decide for B because B relies on what A established.
The receiving organization decides what the evidence is enough for.
The relationship still matters when the establishing organization is not in the decision path.
For B to rely on something established by A, there must be a basis for doing so.
Trust, governing agreements, technical verification and lifecycle arrangements can all remain part of that relationship. If relevant authority is withdrawn or facts change, the resulting state still has to become available to B in the timeframe the access decision requires.
B cannot act on a change it does not know about.
The separation is therefore not that A disappears. It is that A does not necessarily need to participate synchronously whenever B makes the access decision.
The organizations remain dependent on the relationship without every decision depending on both organizations participating at that moment.
The boundary does not have to reset the relationship.
Crossing into another organization's environment often means rebuilding context around the new system.
New account. New enrollment. Another representation of who the person is and why they are there.
Sometimes renewed interaction is necessary. The receiving organization may require additional information, assurance or consent.
But the organizational boundary does not itself make everything already established meaningless.
Relevant evidence can allow established context to remain useful while B still evaluates what that context is sufficient for.
Continuous relationship does not mean continuous permission.
Different decisions can require different dependencies.
The same relationship between A and B can support decisions with different requirements.
For this access decision, B may have enough evidence, trust and sufficiently current state available to evaluate the request without A participating synchronously.
Another decision may depend on shared mutable state, one-use authority or information that must be current at that moment. That decision may still require A or another responsible system to participate.
Both decisions can belong to B. What changes is not who is responsible for them, but what each decision requires.
Responsibility determines who decides. Requirements determine what the decision depends on. The organizational boundary alone determines neither.
Krutho changes what has to happen when the decision is made.
Krutho can enable evidence of what one organization has established to be evaluated within another organization's decision domain, without the establishing organization having to participate when that decision is made.
That can allow A to remain responsible for what it establishes while B remains responsible for what it decides.
Exactly how establishment, issuance, trust, lifecycle state, verification and enforcement are allocated depends on the deployment. Krutho does not make the governing relationship or B's decision requirements disappear, and evidence crossing the boundary does not become automatic permission.
The architectural possibility is specific:
Established elsewhere does not have to mean decided elsewhere.
Evidence
What we have shown.
In testing, a Krutho verifier accepted a reference issuer's test identity credential. In a staged scenario, one demo environment represented both an airline and a partner hotel, and the hotel side made its own check-in decisions from presented evidence. Neither was an independently operated cross-organizational deployment.
The organizations remain separate. So do their responsibilities.
One organization can establish relevant authority or facts.
Another can determine whether evidence of what was established is sufficient for an access decision that belongs to it.
Trust, lifecycle and the governing relationship still connect them. Decision responsibility does not have to.
Authority can cross a boundary without decision responsibility crossing with it.