Why a spine, why now
i-Saves needs to know you are really a teacher on shift. AnKampung needs to know the visitor claim came from an actual resident. AnKedai needs a business registration that is not a photocopy. We could build four identity systems — and Malaysia has effectively done exactly that, one silo per ministry — or recognise that this is one problem with many issuers. AnVerified is the spine: identity proofing anchored to MyDigital ID and registry data we never duplicate, credentials issued by the fiefdom that owns the fact, and verification that returns a boolean and an expiry, never a record.
The 2024 PDPA amendments — mandatory breach notification to the Commissioner, higher penalties, an explicit cross-border regime — moved the cost of hoarding identity data from theoretical to statutory. The architecture answers that directly: minimisation is enforced at the protocol layer, so a verifier that asks for more than the credential carries simply gets a refusal. Compliance stops being a clause in the contract and becomes a property of the handshake.
Prove the claim, not the person
The release design is selective disclosure: a credential that attests "B40, consented, verified this month" without naming the income; "registered kedai, Selangor, in good standing" without the SSM document behind it. Aggregations follow the same floors the rest of the family uses — the crowd, the band, the week — never the individual row. An issuer's air-gap is sovereign by construction: the health ministry's credential and the education ministry's credential do not join anywhere we control, and the audit ledger records every verification — who asked, what fact, what answer — without holding the facts themselves.
This is the piece of plumbing we are deliberately not glamorising. It ships quietly, one issuer at a time — a polytechnic verifying student status for i-Saves first, a gatehouse community second — with the same rule we apply to every frontier claim: no deployment we cannot name.