Annex G: Roles and Actors¶

4.1 Overview of the SEDI Ecosystem¶

The SEDI ecosystem comprises the following roles, each with distinct statutory obligations. An entity may serve multiple roles simultaneously (e.g., a governmental entity may also be a relying party).

4.2 Department / Program¶

Statutory authority: Section 63A-20-202, 203

The Department of Government Operations operates the SEDI program. In identity ecosystem terms, the Department is the issuer: the entity that endorses (digitally signs) the holder's identity attributes, binding them to the holder's personal digital identifier. The Department also sets standards, approves conformance profiles, and operates the issuance and revocation infrastructure.

Key constraint: The Department's role ends at issuance. The statute prohibits the Department from monitoring, surveilling, or tracking presentations (Section 63A-20-301(3)).

Obligations applicable to this role:

4.3 Holders / Individuals¶

Statutory authority: Section 63A-20-101, Section 63A-20-302

A holder is the individual whose identity attributes are contained in the SEDI, or a digital guardian acting on the individual's behalf (Section 63A-20-201(9)). The holder is the sovereign actor in the ecosystem: they control their personal digital identifier, choose their wallet, decide what to disclose, and consent to each presentation.

Rights applicable to this role:

Holders are rights-bearers under the Digital Identity Bill of Rights (Part 1), not obligation-bearers. All SEDI-BOR requirements protect holder rights. See Part 1 for the complete list.

4.4 Digital Wallet Providers¶

Statutory authority: Section 63A-20-401

A digital wallet provider creates, develops, maintains, and makes available the software or hardware that securely stores and presents a SEDI. Multiple wallet providers may exist simultaneously. Holders choose their wallet (Section 63A-20-301(1)(f)), and wallets must be interoperable via open standards.

Obligations applicable to this role:

4.5 Verifiers¶

Statutory authority: Section 63A-20-501

A verifier performs cryptographic verification of a SEDI: confirming the Department's signature, the credential's integrity, and the holder's proof of possession. The verifier role is technically specialized and may be a distinct entity from the relying party.

Obligations applicable to this role:

4.6 Relying Parties¶

Statutory authority: Section 63A-20-601

A relying party consumes the verifier's output to make a trust decision. It relies on the verified assertion of identity or identity attributes. A relying party may accept a SEDI as proof of identity unless a different method is required by law (Section 63A-20-601(4)).

Obligations applicable to this role:

4.7 Identity Proofing Entities¶

Statutory authority: Section 63A-20-201(13), Section 63A-20-303

An identity proofing entity is authorized by the Department to conduct identity proofing for the purpose of issuing a SEDI. This role enables the Department to delegate proofing to qualified third parties (e.g., existing government agencies, authorized private entities) while retaining validation authority (Section 63A-20-301(2)(a)).

Obligations applicable to this role:

4.8 Governmental Entities¶

Statutory authority: Section 63A-20-304

Governmental entities that accept digital identity must, within statutory timelines, also accept SEDI. They are bound by non-discrimination requirements (no benefit for digital over physical) and the prohibition on device surrender.

Obligations applicable to this role:

4.9 Health Care Providers¶

Statutory authority: Section 63A-20-305

Health care providers receiving at least $10,000,000 per year in public funding that already accept digital identity must accept SEDI within two years of first issuance, subject to technical feasibility exemptions.

Obligations applicable to this role:

4.10 Digital Guardians¶

Statutory authority: Section 63A-20-201(3), Section 63A-20-302(2)-(3)

A digital guardian acts on behalf of a minor, incapacitated person, or an individual who has designated a representative. The guardian may apply for, manage, and present a SEDI on the individual's behalf. This role requires a delegation mechanism in the credential system.

Obligations applicable to this role:

4.11 Data Privacy Ombudsperson¶

Statutory authority: Section 63A-19-501 (as amended), Section 63A-20-801

The data privacy ombudsperson receives and reviews complaints alleging violations of Chapter 63A-20 by any ecosystem participant, and may refer complaints to the attorney general.

Obligations applicable to this role:

4.12 Attorney General¶

Statutory authority: Section 63A-20-801(4)

The attorney general has enforcement authority, including civil investigative demands and civil actions for injunctive relief, declaratory relief, damages, restitution, and disgorgement.

Obligations applicable to this role: