Specifications
Cloud & Platform Binding Specification
This specification describes how ECZ-ID can represent a supported relationship between an ECZ-ID and an external cloud, platform, repository, domain, API, agent, model, dataset, MCP or service identifier. Provider identity remains provider-controlled; ECZ-ID adds a neutral accountability route.
INFORMATIVE DRAFT Informative specification
Canonical URL: https://www.ecocitizenz.org/pages/cloud-platform-binding-specification
Binding rule Link to section: Binding rule
A binding helps a reviewer understand the relationship between an ECZ-ID and an external digital surface. It does not replace provider login, account permissions, billing ownership, access control or platform approval.
The binding route Link to section: The binding route
| Step | What happens |
|---|---|
| 1. Target exists | A cloud, platform, domain, repository, API, agent, model, dataset or service identifier exists. |
| 2. Setup starts | The customer follows a supported setup route through TrustOps. |
| 3. Evidence is prepared | Supported challenge, DNS, .well-known, manifest, hash or manual proof material is prepared. |
| 4. Backend decides | The ECZ-ID backend controls whether binding state can advance, degrade, expire, be suspended or be revoked. |
| 5. Resolver projects | Resolver shows only public-safe proof fields, where a projection is available. |
| 6. Reviewer decides | Buyers, agents, auditors, insurers, platforms and policy systems apply their own rules. |
Binding targets Link to section: Binding targets
- Cloud accounts and tenants
- Cloud account, tenant, organisation, workspace or provider-level identifiers where a supported setup route exists.
- Domains and web routes
- Domains, DNS records and
.well-knownfiles used for route alignment and re-checkability. - Repositories and packages
- Repository, package, release and provenance surfaces where operator routing matters.
- APIs and tool surfaces
- API endpoints, OpenAPI metadata, tools and public machine-readable interfaces.
- Agents and MCP servers
- Agent, tool, MCP server and automation surfaces where machines need a route to the accountable operator.
- Models and datasets
- Model, dataset and service surfaces where operator and evidence routing support review.
Provider wording Link to section: Provider wording
Provider names identify where external identifiers exist. They do not imply provider endorsement, certification, affiliation, access rights or approval. A provider route is described only at the level actually supported by ECZ-ID evidence and setup capability.
Support levels used to describe a provider route, from least to most evidenced: listed; manual route; setup pack; route-proven; test-proven; live-proven. A planned connector is not yet a supported route.
What Resolver may and may not show Link to section: What Resolver may and may not show
Resolver may show
- The parent ECZ-ID and public-safe binding identifiers.
- Binding state, route state and target class.
- Masked identifiers and fingerprint hashes.
- Public-safe timestamps, freshness and re-check guidance.
- Public-safe receipt references.
- Machine-readable output for public re-check routes.
Resolver does not show
- Secrets, credentials, tokens, OAuth grants or cloud keys.
- Raw tenant IDs, account IDs, ARNs or private provider payloads.
- Private documents, raw telemetry, source code or operational logs.
- Payment status presented as proof of control.
- Provider approval, certification, endorsement or access-right claims.
- Safety, compliance, insurance or business-quality guarantees.
Reading a binding Link to section: Reading a binding
- Binding route
- A structured route from an external identifier to an ECZ-ID accountability record.
- Current state
- Check current public state in Resolver, where a public proof route is available.
- Review decision
- Buyers, agents, insurers, auditors, platforms and counterparties apply their own review policies.
- Interpretation limit
- A binding does not replace provider login, account permissions, access control, billing ownership or provider identity systems.
Where to go next Link to section: Where to go next
Read the binding overview — ecocitizenz.com
- Why leave this site
- You want a plain-language commercial explanation of cloud and platform binding.
- Where you go
- ecocitizenz.com (www.ecocitizenz.com)
- Authority there
- Commercial and category discovery: offers, corridors and use cases.
- What happens next
- Read the commercial overview of binding on ecocitizenz.com.
Acquire, activate, manage or pay — TrustOps
- Why leave this site
- You want to acquire, activate, manage or pay for an ECZ-ID or Passport.
- Where you go
- TrustOps (trustops.ecocitizenz.com)
- Authority there
- Acquisition, payment, entitlement, activation and lifecycle operations.
- What happens next
- Start or manage the operational acquisition and lifecycle flow. Payment or activation is not itself proof.
Verify — Resolver
- Why leave this site
- This page explains rules. It cannot show whether a particular ECZ-ID, Passport or binding is current.
- Where you go
- Resolver (resolver.ecocitizenz.org)
- Authority there
- Current public proof: a read-only projection of backend-controlled state.
- What happens next
- Open the ECZ-ID or Passport record and re-check its current public status before you rely on it.
Implement — Developer Gateway
- Why leave this site
- You need schemas, SDKs, route indexes or integration patterns rather than governance text.
- Where you go
- Developer Gateway (developers.ecocitizenz.com)
- Authority there
- Implementation, interoperability, SDK and schema guidance. It is not live proof.
- What happens next
- Use the implementation guides and reference material. Live proof still comes from Resolver.
Read together Link to section: Read together
Revision history Link to section: Revision history
| Date | Version | Status | Change summary |
|---|---|---|---|
| No controlled revision of this document has been published. Earlier versions of this page on the Shopify-hosted site were not issued under a documentary authority record, so no history is backfilled. | |||
Recommended citation Link to section: Recommended citation
EcoCitizenz Ltd, Cloud & Platform Binding Specification, DRAFT, https://www.ecocitizenz.org/pages/cloud-platform-binding-specification.
Fields that do not yet exist for this document, such as a document ID or version, are omitted rather than invented.