OpenID Death and the Digital Estate Event Profile 1.0 - draft 00

1.1. Relationship to Other Event Sets

The Shared Signals Framework specifies the transport: stream configuration and management, and delivery by push [RFC8935] or poll [RFC8936] of SETs about subjects identified per [RFC9493]. The event sets carried over it are separate documents, each scoped to a subject matter. This profile is one such set. Its subject matter — the legal status of a person and the authority others hold over their affairs — is not addressed by any existing set, and this document neither extends nor profiles any of them.¶

An implementation that already operates an SSF transmitter or receiver reuses it unchanged. What it gains here is the event types in Section 3, the common claims in Section 2, and the subject format in Section 4.¶

1.2. Scope

In scope: the transitions that change who may act for a person, or that change the standing of someone already acting.¶

Out of scope, and deliberately so:¶

• The legal consequence of a transition. See Section 1.3.¶

• The content of any authority. What an executor may do with an account is a matter for the custodian's terms and the law of the estate, not for an event.¶

• Identity proofing of the claimant. Where evidence travels with an event it uses the structures of [IDA]; this profile does not define new ones.¶

• Authorization. A Receiver's decision to grant or deny access on the strength of an event is local policy. Nothing in this profile is a command.¶

1.3. Facts, not Effects

A Transmitter asserting one of these events asserts that something happened, not what follows from it in law. This is not reticence; it is a requirement drawn from the jurisdictional survey.¶

Consider a single transition: a court appoints a conservator over the property of a person who had previously granted a power of attorney. Across seven US states that one event has five different effects on the existing power: in Virginia the agency continues; in West Virginia and Kentucky it terminates; in Missouri the court allocates functions between the two fiduciaries; in Nebraska and Kansas the conservator acquires the principal's own power to revoke it; and in Iowa the power is suspended and later reinstated if the principal regains capacity.¶

An event that asserted "the power of attorney is terminated" would therefore be wrong in five of those seven states. An event asserting "a conservator was appointed over this principal's property, under the law of Iowa, as at this date" is correct in all of them, and leaves the consequence to be evaluated by whoever is entitled to evaluate it.¶

The survey supplies a second case with a different shape, and it is the reason governing_law carries a date rather than only a jurisdiction. Colorado runs two durability tests at once, selected by the age of the instrument. A power of attorney created on or after 1 January 2010 is durable by default; one existing on 31 December 2009 is durable only if it satisfied a magic-words test in a section the 2009 act superseded — and that section is still in force for the older cohort. Two instruments presented on the same morning, identical on their face, are governed by different tests because one was signed in 2008.¶

So it is not enough for a Receiver to know which jurisdiction's law applies. It has to know as of when, and for some transitions that date is a property of the instrument rather than of the event. A Transmitter reporting on an authority whose governing test turns on the instrument's age SHOULD carry that date in evidence (Section 2), because event_timestamp is the time of the transition and will not supply it.¶

Accordingly every event in this profile carries governing_law (Section 2), and a Transmitter that cannot or will not characterise the legal effect of the transition it is reporting SHOULD set effect_unspecified to true.¶

1.4. Notational Conventions

The keywords "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.¶

The terms Transmitter, Receiver, Stream, Subject and SET are used as defined in [SSF] and [RFC8417].¶

Principal denotes the person whose death, capacity or affairs the event concerns. Holder denotes a party who holds, claims, or is refused an authority over the Principal or their estate.¶

3.1. principal-deceased

Event Type URI: https://schemas.openid.net/secevent/dade/event-type/principal-deceased¶

The principal-deceased event signals that the death of the Principal has been recorded. It is the transition on which most of the rest of this profile depends.¶

Two properties distinguish it from a simple assertion of fact. First, a death record can be wrong and can be withdrawn; a Transmitter MUST be able to correct one, and does so by sending a further principal-deceased event with record_status set to withdrawn and corrects set to the jti of the original. Second, the proof of death is not always a death certificate, and the window in which it is not is precisely the window in which a family first contacts a custodian.¶

Attributes:¶

• record_status - RECOMMENDED, JSON string: one of recorded, amended or withdrawn. If omitted, recorded is assumed. A Transmitter sending amended or withdrawn MUST include corrects.¶

• date_of_death - RECOMMENDED, JSON string: the date of death in the format YYYY-MM-DD, or, where the law of the jurisdiction permits a finding of presumed death, the date fixed by that finding.¶

• death_type - OPTIONAL, JSON string: one of registered (a civil registry holds the record), certified (a clinician certified it), judicial (a court declared or presumed it), or reported (asserted to the Transmitter without either).¶

• proof - OPTIONAL, JSON string: the artefact on which the record rests. This MUST be one of the following, or any other value mutually understood by the parties:¶

  • death-certificate - a certified or authenticated copy.¶

  • abstract-of-death - an abstract issued where a certificate is delayed. [ROLES] records a statute accepting this expressly for that reason.¶

  • funeral-expense-attestation - proof of payment of funeral expenses, accepted in at least one jurisdiction in place of a certificate.¶

  • registry-record - the Transmitter is itself the registry.¶

  • court-order - a judicial declaration of death.¶

• registry_reference - OPTIONAL, JSON string: an opaque reference to the record in the Transmitter's register, for later correlation.¶

The following example is non-normative.¶

{
  "iss": "https://registry.example.gov/",
  "jti": "a1b2c3d4e5f60718293a4b5c6d7e8f90",
  "iat": 1792108800,
  "aud": "https://platform.example.com/ssf",
  "txn": "dade-2026-0001",
  "sub_id": {
    "format": "principal",
    "principal_ref": "opaque:7f3c91a0e2",
    "jurisdiction": "US-IA"
  },
  "events": {
    "https://schemas.openid.net/secevent/dade/event-type/principal-deceased": {
      "record_status": "recorded",
      "date_of_death": "2026-10-02",
      "death_type": "registered",
      "proof": "death-certificate",
      "registry_reference": "IA-2026-114502",
      "initiating_authority": "registrar",
      "governing_law": { "jurisdiction": "US-IA", "as_at": "2026-10-14" },
      "event_timestamp": 1791936000
    }
  }
}

3.2. principal-capacity-changed

Event Type URI: https://schemas.openid.net/secevent/dade/event-type/principal-capacity-changed¶

The principal-capacity-changed event signals that a determination has been made about the Principal's capacity, or that an earlier determination has ceased to hold. Both directions are carried by one event type because the transition is symmetrical and because the reverse direction is load-bearing: authority suspended on a finding of incapacity may revive when capacity returns.¶

The determination is not self-certifying and does not expire silently. [ROLES] records statutory shelf lives on such findings ranging from two hours to five years, after which the finding must be made again; a Transmitter that knows the applicable limit SHOULD convey it in expires_at.¶

Attributes:¶

• capacity_status - REQUIRED, JSON string: one of impaired (a determination of incapacity has been made), restored (capacity has been found to have returned), or contested (the determination is under challenge).¶

• determiner - RECOMMENDED, JSON string: who made the determination. This MUST be one of physician, psychologist, nurse-practitioner, physician-assistant, judge, governmental-official, or panel where the law requires more than one.¶

• scope - RECOMMENDED, JSON string: one of property, person, or both. A determination of incapacity for financial purposes does not necessarily extend to health-care decisions, and conflating them over-reports.¶

• finding_date - OPTIONAL, JSON string: the date of the determination, in the format YYYY-MM-DD.¶

• expires_at - OPTIONAL, JSON number: the time, in seconds from 1970-01-01T0:0:0Z as measured in UTC, after which the determination no longer holds without being made again. A Receiver MUST NOT treat a determination as continuing past this time.¶

• objection - OPTIONAL, JSON boolean: true where the Principal has objected to the determination and the law of the jurisdiction gives that objection effect.¶

The following example is non-normative.¶

{
  "iss": "https://ehr.example.org/",
  "jti": "11d0f2a37c9b48e5a6071829b3c4d5e6",
  "iat": 1792108900,
  "aud": "https://platform.example.com/ssf",
  "sub_id": {
    "format": "principal",
    "principal_ref": "opaque:7f3c91a0e2",
    "jurisdiction": "US-UT"
  },
  "events": {
    "https://schemas.openid.net/secevent/dade/event-type/principal-capacity-changed": {
      "capacity_status": "restored",
      "determiner": "physician",
      "scope": "both",
      "finding_date": "2026-10-11",
      "initiating_authority": "clinician",
      "governing_law": { "jurisdiction": "US-UT", "as_at": "2026-10-14" },
      "corrects": "0c9e8d7a6b5c4d3e2f10112233445566",
      "reason_admin": {
        "en": "Capacity found restored on re-examination; prior finding of 2026-08-02 no longer holds."
      }
    }
  }
}

3.3. authority-changed

Event Type URI: https://schemas.openid.net/secevent/dade/event-type/authority-changed¶

The authority-changed event signals a change in the standing of a legal authority held, or to be held, by a Holder over the Principal or their estate. One event type carries the whole lifecycle, with authority_status selecting the transition, because the parties, the role and the bounds are the same in each case and only the transition differs.¶

Three of the authority_status values exist because the surveyed law requires them and a two-state model cannot express them.¶

suspended and reinstated. An authority may be valid, temporarily ineffective, and then effective again, with nothing issued or withdrawn at either boundary. [ROLES] records a statute under which the appointment of a conservator suspends an existing power of attorney, which is then "reinstated upon termination of the conservatorship as a result of the principal regaining capacity", and another under which a health-care authority commences, ceases and resumes with successive clinical findings. A Receiver that models authority as present or absent will either honour a dormant authority or refuse a revived one.¶

registered. In ten of the forty-four jurisdictions that record the point, a power must be registered or filed before it can be used, so there is a period in which the instrument exists, is valid, and confers nothing. In one of them registration is constitutive rather than procedural: the statute does not provide that the power must be registered before use, it provides that the power is not created unless registered. The registration_effect attribute distinguishes these, because a Receiver that conflates them will either honour an authority that does not exist or refuse one that does.¶

Attributes:¶

• authority_status - REQUIRED, JSON string: the transition. This MUST be one of:¶

  • granted - the authority has been conferred.¶

  • registered - a registry or court has completed the step that makes the authority effective, or that creates it; see registration_effect.¶

  • suspended - the authority continues to exist but is not currently effective.¶

  • reinstated - a suspended authority is effective again.¶

  • scope-changed - the bounds of the authority have moved; the authority has not ended.¶

  • devolved - the authority has passed from one Holder to another, for example to an alternate on the first Holder's forfeiture.¶

  • terminated - the authority has ended and will not revive.¶

• holder - RECOMMENDED, JSON object: identifies the Holder. It MUST contain a holder_ref (JSON string, an opaque reference as described in Section 4) and MAY contain holder_type (one of natural-person, legal-person, public-office).¶

  This claim is RECOMMENDED rather than OPTIONAL because in at least one jurisdiction the Holder cannot be derived at all. Every default health-care decision-maker in [ROLES] but one is the output of a statutory priority list, which a Receiver holding the family tree could in principle compute. In the exception, the statute ranks nobody: a class of "interested persons" — including any close friend — must reach a consensus on who among them will decide, with only qualitative guidance, no tie-break, and guardianship as the sole route out of disagreement. Where none can be found or none is willing, the attending physician may designate another physician. A Receiver cannot work that out from any data it holds; it can only be told, which is what this claim is for.¶

• artefact - OPTIONAL, JSON string: what evidences the authority. This MUST be one of letters, grant, certificate-of-inheritance, court-order, instrument, affidavit, certification-of-trust, register-entry, platform-record, or none. The last value is not an error: in a substantial minority of jurisdictions the authority arises with no artefact at all.¶

• scope - OPTIONAL, JSON object: the bounds of the authority as stated on its face. It MAY contain limits (JSON array of strings), monetary_ceiling (JSON object with amount as a JSON number and currency as an ISO 4217 code), and co_holders (JSON object with count as a JSON number and acting as one of jointly, independently, or majority). Amounts MUST be expressed in the currency of the governing jurisdiction and MUST NOT be converted.¶

• registration_effect - OPTIONAL, JSON string: present where authority_status is registered. One of activates (the instrument already existed and registration makes it effective) or creates (the authority does not exist until registration).¶

• revival - OPTIONAL, JSON string: present where authority_status is suspended. One of automatic (the authority revives on a condition without further order, so the suspension is known in advance not to be terminal), order-required, or none.¶

• cause - OPTIONAL, JSON string: why the transition occurred. This MUST be one of death, revocation, court-appointment, court-order, conviction, administrative-finding, non-exercise, expiry, purpose-fulfilled, resignation, capacity-restored, or any other value mutually understood by the parties.¶

• predecessor - OPTIONAL, JSON object: present where authority_status is devolved. Identifies the Holder from whom the authority passed, with the same structure as holder.¶

A Transmitter SHOULD send reinstated when a suspension it reported has ended, rather than leaving a Receiver to infer it from a principal-capacity-changed event, because the inference is jurisdiction-dependent.¶

The following example is non-normative. It shows a power of attorney suspended by the appointment of a conservator, with the suspension marked as one that will revive automatically.¶

{
  "iss": "https://court.example.gov/",
  "jti": "99aa88bb77cc66dd55ee44ff33221100",
  "iat": 1792109000,
  "aud": "https://platform.example.com/ssf",
  "txn": "dade-2026-0042",
  "sub_id": {
    "format": "principal",
    "principal_ref": "opaque:7f3c91a0e2",
    "jurisdiction": "US-IA"
  },
  "events": {
    "https://schemas.openid.net/secevent/dade/event-type/authority-changed": {
      "authority_status": "suspended",
      "canonical_role": "financial-poa-durable",
      "holder": { "holder_ref": "opaque:b21c7e", "holder_type": "natural-person" },
      "artefact": "instrument",
      "cause": "court-appointment",
      "revival": "automatic",
      "initiating_authority": "court",
      "governing_law": { "jurisdiction": "US-IA", "as_at": "2026-10-14" },
      "effect_unspecified": false,
      "reason_admin": {
        "en": "Conservator appointed; power of attorney suspended and revives if capacity is regained."
      }
    }
  }
}

3.4. direction-recorded

Event Type URI: https://schemas.openid.net/secevent/dade/event-type/direction-recorded¶

The direction-recorded event signals that the Principal has lodged a direction with a custodian about post-mortem access to their accounts or data, or has withdrawn one.¶

This is not a variant of authority-changed, and the distinction is the reason the event exists. A direction is not necessarily a grant. In one surveyed jurisdiction the deceased's data-protection rights are exercisable by an interested person unless the deceased forbade it in writing to the controller, and that prohibition binds. In another, directions may permit or forbid and are lodged with the controller concerned, require the data subject's specific consent, and expressly may not result from their mere acceptance of the terms of use; a terms-of-service clause cutting across that right is void. An event vocabulary that can only say that someone now holds an authority cannot carry either, and a Receiver implementing only the permitting case silently mis-implements the prohibiting one.¶

The addressee matters as much as the content. Where the law gives a prohibition effect by virtue of its having been lodged with the controller, the custodian is not a relying party assessing someone else's instrument; it is the party to whom the instrument was given.¶

Attributes:¶

• direction_status - REQUIRED, JSON string: one of recorded or withdrawn. A Transmitter sending withdrawn SHOULD include supersedes.¶

• effect - REQUIRED, JSON string: one of permit or forbid. The forbid value is a first-class direction and MUST NOT be represented as the absence of a permit.¶

• lodged_with - RECOMMENDED, JSON string: an identifier for the custodian or controller with which the direction was lodged, where the law attaches significance to the addressee.¶

• designee - OPTIONAL, JSON object: where the direction names a person to act, with the same structure as holder in authority-changed.¶

• scope - OPTIONAL, JSON object: what the direction reaches. It MAY contain assets (JSON array of strings, for example content, catalogue, account-control, deletion) and exclusions (JSON array of strings).¶

• precedence - OPTIONAL, JSON string: the direction's rank against other instruments, where the governing law states one. One of overrides-other-records (the direction prevails over a contrary direction in a will, trust, power of attorney or other record) or subordinate.¶

• revocable - OPTIONAL, JSON boolean: whether the Principal may withdraw the direction at any time. Where the law requires that the custodian's tool permit modification at any time as a condition of the direction's precedence, a Transmitter SHOULD set this to true and set precedence accordingly.¶

The following example is non-normative. It shows a prohibition.¶

{
  "iss": "https://platform.example.com/",
  "jti": "cc00dd11ee22ff33445566778899aabb",
  "iat": 1792109100,
  "aud": "https://executor-service.example.net/ssf",
  "sub_id": {
    "format": "principal",
    "principal_ref": "opaque:7f3c91a0e2",
    "jurisdiction": "IT"
  },
  "events": {
    "https://schemas.openid.net/secevent/dade/event-type/direction-recorded": {
      "direction_status": "recorded",
      "effect": "forbid",
      "lodged_with": "https://platform.example.com/",
      "scope": { "assets": ["content", "catalogue"] },
      "revocable": true,
      "initiating_authority": "principal",
      "governing_law": { "jurisdiction": "IT", "as_at": "2026-10-14" },
      "reason_user": {
        "it": "Hai chiesto che i tuoi dati non siano resi accessibili ad altri dopo la tua morte."
      }
    }
  }
}

3.5. authority-refused

Event Type URI: https://schemas.openid.net/secevent/dade/event-type/authority-refused¶

The authority-refused event signals that a custodian has declined to honour an authority presented to it, and states the ground.¶

This event travels in the opposite direction to every other event in this profile, and it exists because at least one legislature already requires it. In the jurisdiction concerned, a person refusing to accept the authority of a guardian or conservator must, within ten days of the refusal, report the refusal and the reason for it to the court that issued the letters of office, where it is treated as a grievance. The custodian is the Transmitter and the issuing authority is the Receiver.¶

Because SSF Streams are unidirectional, a deployment supporting this event establishes a Stream in which the issuing authority is the Receiver, distinct from any Stream over which that authority transmits.¶

A refusal is a legitimate outcome and not an error. Several of the surveyed statutes enumerate the grounds on which an authority may lawfully be refused, and two enumerate grounds on which it may not be; the grounds registry in Section 6 is drawn from them.¶

Attributes:¶

• grounds - REQUIRED, JSON array of strings: one or more values from the registry in Section 6, or any other value mutually understood by the parties. A Transmitter MUST NOT send an empty array.¶

• holder - RECOMMENDED, JSON object: the party whose authority was refused, with the same structure as holder in authority-changed.¶

• presented_at - OPTIONAL, JSON number: the time the authority was presented to the custodian, in seconds from 1970-01-01T0:0:0Z as measured in UTC. Where a statute imposes a deadline for reporting a refusal, this is the time from which it runs.¶

• artefact - OPTIONAL, JSON string: what was presented, using the values of artefact in authority-changed.¶

• report_deadline - OPTIONAL, JSON number: the time by which the governing law requires the refusal to be reported, where it imposes one.¶

• remediable - OPTIONAL, JSON boolean: whether the custodian would honour the authority if the ground were addressed. A refusal for want of evidence of a contingency is remediable; one resting on knowledge of abuse is not.¶

The following example is non-normative.¶

{
  "iss": "https://platform.example.com/",
  "jti": "5566778899aabbccddeeff0011223344",
  "iat": 1792109200,
  "aud": "https://court.example.gov/ssf",
  "txn": "dade-2026-0042",
  "sub_id": {
    "format": "principal",
    "principal_ref": "opaque:7f3c91a0e2",
    "jurisdiction": "US-KS"
  },
  "events": {
    "https://schemas.openid.net/secevent/dade/event-type/authority-refused": {
      "grounds": ["abuse-report-made"],
      "holder": { "holder_ref": "opaque:b21c7e", "holder_type": "natural-person" },
      "artefact": "letters",
      "presented_at": 1792022800,
      "report_deadline": 1792886800,
      "remediable": false,
      "initiating_authority": "custodian",
      "governing_law": { "jurisdiction": "US-KS", "as_at": "2026-10-14" },
      "reason_admin": {
        "en": "Refused: a report under the adult protective services statute has been made naming the guardian."
      }
    }
  }
}

10.1. Normative References

[RFC2119]

Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, <https://www.rfc-editor.org/rfc/rfc2119>.

[RFC5646]

Phillips, A., Ed. and M. Davis, Ed., "Tags for Identifying Languages", BCP 47, RFC 5646, DOI 10.17487/RFC5646, September 2009, <https://www.rfc-editor.org/rfc/rfc5646>.

[RFC8174]

Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, <https://www.rfc-editor.org/rfc/rfc8174>.

[RFC8417]

Hunt, P., Ed., Jones, M., Denniss, W., and M. Ansari, "Security Event Token (SET)", RFC 8417, DOI 10.17487/RFC8417, July 2018, <https://www.rfc-editor.org/rfc/rfc8417>.

[RFC8935]

Backman, A., Ed., Jones, M., Ed., Scurtescu, M., Ansari, M., and A. Nadalin, "Push-Based Security Event Token (SET) Delivery Using HTTP", RFC 8935, DOI 10.17487/RFC8935, November 2020, <https://www.rfc-editor.org/rfc/rfc8935>.

[RFC8936]

Backman, A., Ed., Jones, M., Ed., Scurtescu, M., Ansari, M., and A. Nadalin, "Poll-Based Security Event Token (SET) Delivery Using HTTP", RFC 8936, DOI 10.17487/RFC8936, November 2020, <https://www.rfc-editor.org/rfc/rfc8936>.

[RFC9493]

Backman, A., Ed., Scurtescu, M., and P. Jain, "Subject Identifiers for Security Event Tokens", RFC 9493, DOI 10.17487/RFC9493, December 2023, <https://www.rfc-editor.org/rfc/rfc9493>.

[SSF]

"OpenID Shared Signals Framework Specification 1.0", 2025, <https://openid.net/specs/openid-sharedsignals-framework-1_0.html>.

[IDA]

"OpenID Connect for Identity Assurance 1.0", 2024, <https://openid.net/specs/openid-connect-4-identity-assurance-1_0-final.html>.

10.2. Informative References

[DADE-PAPER]

Flanagan, H., Kiser, M., and D. Saxe, "The Unfinished Digital Estate: Culture, Law, and Technology after Death", 2026, <https://openid.net/wp-content/uploads/2026/03/The-Unfinished-Digital-Estate-Final.pdf>.

[DADE-EVENTS]

"DADE Event Reference", 2026, <https://derrumbe.github.io/openid-dade-events/dade-event-reference.html>.

[ROLES]

"Digital Estate Roles: when authority is assigned, when it starts, and when it ends", 2026, <https://xebecstudios.org/research/digital-estate-roles/>.

A family contacts a platform after a death

A civil registry transmits principal-deceased. The platform does not grant anything on that alone; it learns that a claim is now possible and that its inactivity timers should not run. When a Holder later presents a grant, the platform has already correlated the death and can evaluate the authority against the jurisdiction the registry named.¶

A power of attorney goes dormant and comes back

A court transmits authority-changed with authority_status of suspended, cause of court-appointment and revival of automatic. The platform stops honouring the agent without revoking anything or asking the agent to re-enrol. Months later the same court transmits reinstated, and the agent resumes. No instrument changed at either boundary, and without the events the platform would have had no way to learn of either.¶

A custodian says no, and the court finds out

A platform refuses letters of office it has reason to believe are being misused and transmits authority-refused with grounds of abuse-report-made to the issuing court, within the period the governing law allows. The court treats it as a grievance. The platform has discharged a statutory duty it would otherwise have had to discharge on paper, and the refusal has reached the only party able to act on it.¶

A prohibition is honoured

A user lodges a direction forbidding post-mortem disclosure. The platform records it and transmits direction-recorded with effect of forbid to an estate service the user also uses. When the user dies, the estate service already knows not to ask.¶