Civitas ID White Paper White paper version 3.0 · 30 October 2026
All pages

Goal-path orchestration

From the white paper: section 4.3 describes a guided path from a stated goal, such as "open an account", to the credentials a person lacks; this page separates the one step of that path that runs today from the engine that does not yet exist.

What runs today. The shipped iOS and Android wallet resolves one step of a goal path on its own Live. When a verifier's request names a credential the holder does not have, the wallet searches its local service catalog for an interaction that issues the required credential type, offers the matching issuers, opens the issuing interaction, and returns the holder to the request that was blocked. This navigation runs entirely on the device, against the catalog the wallet already holds. It needs no new service and no server-side reasoning, and it is the seed the rest of this page grows from. A second seed exists on the platform: Custom Profiles can chain interactions into a goal-oriented flow In build: experimentation mode, configurable only through support, so they are a mechanism to learn from rather than a product surface.

What the engine is designed to do. The goal-path engine converts a stated goal, such as "get a microloan" or "renew my documentation", into an executable sequence of credential interactions Research: no code exists; the execution engine is a funded roadmap item targeted for August 2027. The holder should not need to understand each institution's credential requirements, the order of verification steps, or the data each relying party will request. The engine is designed to work from three inputs:

It maps the goal against country-specific rules, checks what the holder already has without reading personal data, and generates a step-by-step pathway showing what is missing and how to obtain, share or verify each piece. Paths are designed to adapt as context changes: if a document expires mid-journey, or the holder moves, the engine rebuilds the path. That matters for mobile populations, for whom a change of location can change the credential requirements entirely.

Where the reasoning runs. The design constraint is computation locality: reasoning over wallet context happens on the device wherever possible, so the data that informs a person's next step does not have to leave their phone to produce that step. A server is consulted only where the path depends on information the device cannot hold current, such as a provider's present acceptance criteria, and then with the minimum necessary, non-identifying data. This constraint is not yet implemented or measured beyond the navigation seed above, and the seed is a narrow case: a catalog lookup, not planning. How much of the reasoning a low-cost handset can carry, and how much must run on a server for a path to stay current, is a question the first pilot has to measure, not one the design settles. The goal-path rules themselves are designed to be held in the Ecosystem Console, which by design stores no personal data and no user-level logs; the wallet context the engine reasons over stays with the holder.

What sits above the engine. The conversational assistant that would explain a path in the local language, watch for expiry, and execute pre-authorized steps under a bounded, revocable delegation is a separate layer with its own page. It is also research: no agent or model code exists in any layer of the stack today. The Resource Center, which would let a person start a goal path directly from a service description, is not built either.

What a pilot must show. The funded program carries its own test: a real user completing a goal path within 90 days. Until a pilot shows that, and shows where the on-device line actually falls on the handsets people in the target countries carry, goal-path orchestration remains a design with one live step, and this paper presents it as exactly that.

Status, 2026-09-11: the missing-credential navigation runs in the shipped iOS and Android wallet today; the goal-path engine has no code and is a funded roadmap item targeted for August 2027, and computation locality is a design constraint not yet implemented or measured beyond that navigation.