M5-02 Disclosure Policy / Level-of-Assurance Configuration¶
Milestone: M5 — Disclosure and Verification SOW Reference: FR2 Requirement Clarity: ⚠️ Blocking — scope depth unconfirmed. The original v3 requirements doc (Appendix 1, "Policy admin page for types of Credentials needed to confirm identity") explicitly says this is post-MVP, with the MVP using a fixed default (proof of email address only, one default identity type for all staffing companies). The SOW's FR2 describes full configurable policies (email, phone, driver's licence, national ID) with no such deferral. Get this confirmed with Curo before estimating or building. Dev Status: ❌ Not started
Overview¶
Configure what level of assurance / what data a Relying Party requires an individual to share when disclosing credentials, mirroring the policy capability in the Velocity Credential Agent.
Backend Tasks¶
- First: get written confirmation from Curo on scope — default-only (matches original MVP intent) vs. fully configurable (matches SOW literal text)
- If default-only: hardcode a single sensible default policy (e.g. email verification) across all organisations
- If fully configurable: build a policy model + admin UI to define required disclosure fields per organisation, and pass that policy through to the Velocity Credential Agent's disclosure configuration
Frontend Tasks¶
- If fully configurable: build the policy admin page under org settings
Dependencies¶
- M5-01 disclosure request setup — the request references this policy.
- M1-01 — this is one of the named items to resolve during requirements sign-off.
Acceptance Criteria¶
- Velocity policy configuration can be created (per SOW Appendix 3, FR2 acceptance criteria) — note the criterion itself doesn't specify depth, which is exactly the ambiguity to resolve.
Existing Reference Material¶
Blockers & Risks¶
- Blocking: effort estimate for this task (and by extension M5/M6 as a whole) cannot be finalised until scope is confirmed.