1 / 20
A step-by-step demonstration of consent-based digital identity in action
This proof of concept demonstrates how a consent-first digital identity system could operate in an Australian financial services context. The walkthrough covers five key stages — from identity setup through to verified data sharing and audit trail review.
Click through every screen of the HR Onboarding & IP Proof journey in a mobile-app preview.
The DoF Candidate is sent an invitation for their specific job offer and to commence the process via myID Consent link. This link lands at the appropriate Government branded MyID Consent overview page with instructions to download the app or access the webservice.
A API screening/vetting party — such as for Security screening, Police check, Right to Work or HR systems — requests access to specific identity attributes. The user receives a clear, plain-language consent request related to the specific job pack or where they have opted in for other shared services use.
Upon consent, only the approved attributes are shared — nothing more. Zero-knowledge proof techniques can verify claims without revealing underlying data.
The relying party verifies the credential's authenticity against the issuer's public key — without contacting the issuer directly. Trust is established cryptographically.
Every consent event is logged in an immutable audit trail. The user retains the right to withdraw consent at any time, immediately revoking the relying party's access.
The PoC is built on open, interoperable standards — ensuring no vendor lock-in and full alignment with international best practice.
W3C DID standard enables self-sovereign identity — users control their own identifiers without relying on any central authority.
W3C VC standard enables tamper-evident, cryptographically signed credentials that can be verified by any party without contacting the issuer.
Personal Online Datastores (Pods) give users a secure, private data store they control — granting and revoking access on their own terms.
Prove a claim is true — such as "over 18" or "Australian resident" — without revealing the underlying personal data.
This PoC is designed with Australian regulatory requirements at its core — not as an afterthought.
Consent-first design, accredited issuer framework, and interoperability requirements are all addressed within this PoC architecture.
Selective disclosure and granular consent management align directly with CDR's data minimisation and purpose limitation principles.
Immutable audit trails, consent withdrawal rights, and data minimisation support compliance with Australian Privacy Principles.
For organisations operating across jurisdictions, the architecture supports GDPR's right to erasure and data portability requirements.
See how Affinidi and Inrupt each approach the technical challenges outlined in this walkthrough.