One scholarship credential, followed from a school counsellor's desk into a student's AI Passport and out to a provider — who learns exactly one thing, and nothing underneath it.
Applicant
Maria, 17 — senior at Lincoln High
Applying to the Elmwood County Rotary Scholarship, which requires household income under a set threshold and first-generation college status. She would rather not send her family's tax return to thirty volunteer inboxes.
00 — Today, without Encompass
Thirty scholarships. Thirty copies of her family's finances.
Every provider asks for the proof underneath the yes-or-no question: tax returns, FAFSA summaries, a signed letter. Maria either finds every document again for every application, or — like many students in mixed-status or foster households — quietly stops applying.
MariaApplicant
tax_return.pdf4 pages
fafsa_summary.pdf2 pages
counsellor_letter.pdf1 page
Copied and re-sent to each provider individually.
30 providersVolunteer-run
Each one now holds a full income document, with no retention policy and no security review — liability nobody asked for.
01 — Issuance
The counsellor signs a fact once — not a document.
Ms. Alvarez doesn't send a number. She signs which band Maria's income falls in, and that she's first-generation, as salted hashes under the district's key. The plaintext never leaves the district's system.
Lincoln HS · Counsellordid:web
Credential · SD-JWT VC
income_bandsha256:…
first_gensha256:…
countysha256:…
expires2027-06-30
SIGNEDdistrictdid:web
MariaAI Passport
Plaintext values and salts land only on Maria's device. The district keeps a hash, an issuer ID, and an expiry — nothing that identifies her.
02 — Held
Two verified claims now live in her Passport, marked apart from anything she typed.
A claim her counsellor certified never quietly blends in with one she asserted herself. That line is the difference between an assistant that knows her writing style and one that can act where money changes hands.
Maria's AI PassportLocal · encrypted
Verified — signed by Lincoln HS
income_bandheld
first_genheld
Self-asserted — Maria told me
essay_topicheld
intended_majorheld
03 — Request
Elmwood Rotary asks — and has to say why.
Every request carries a declared purpose. The Passport checks the fields asked against what that purpose actually requires. Here, one field doesn't hold up.
Elmwood RotaryVerifier
Declared purpose: confirm income-band and first-generation eligibility for the 2026 scholarship cycle.
Fields requested
income_band ≤ 3requested
first_genrequested
full_namerequested
Over-ask flagged. full_name isn't required by the declared purpose. Logged whether or not Maria accepts.detail
The declared purpose is confirming income-band and first-generation eligibility. Nothing about a name is needed to answer either predicate — a boolean is enough. Elmwood's request for full_name is logged as an over-ask regardless of what Maria decides next, so the pattern stays visible even if she says yes.
MariaAI Passport
Request received. Building a disclosure preview before anything is shared.
04 — Disclosure preview
Maria sees exactly what leaves, before it leaves.
Toggle each requested field yourself. The two eligibility predicates are what Elmwood's purpose actually needs — try switching on full_name and see what happens.
Requested fieldstap to toggle
income_band ≤ 3
required for declared purpose
first_gen
required for declared purpose
full_name
flagged over-ask — not required
Sharing this isn't recommended — it isn't required to prove either predicate, and once shared it can't be un-shared. Encompass logs the over-ask either way.
county scholarships Maria could clear the eligibility bar for with this disclosure.
Always stays hidden
exact income figure — never computed
tax return, county, essay_topic — not requested
05 — Selective disclosure
What she approved unlocks. The rest stay hashes nobody can invert.
Every field she didn't switch on stays redacted — but the district's original signature still verifies over the whole structure, so the provider can trust exactly what it received.
Presented · one-time nonce
income_band ≤ 3TRUE
first_genTRUE
full_name
county
income (exact)
SIGNEDdistrictstill valid
06 — Verification
Four checks. About a second. No call to the district.
Elmwood's system runs entirely against what it already has — it never learns which student is being checked, and it never sees the district's live records.
Issuer signature
Did a real school district sign this claim set?
Holder signature over a fresh nonce
Is this Maria presenting it right now — not a replay of an old proof?
Revocation status
One bit, checked in a downloaded list — the district never learns who looked.
Predicate
income_band ≤ 3 and first_gen both hold.
District status listbit —
Bit not yet read.
07 — Result
Eligible — and that's all Elmwood ever learns.
Verified: income_band ≤ 3, first_gen = true
Signed by Lincoln HS · presented once · logged in Maria's disclosure history
Elmwood still makes the actual scholarship decision — Encompass never decides eligibility for them. It hands them a verified fact instead of a document packet nobody wanted to send or store. What they never saw:
08 — Optional tier · government-ID proof
When there's no counsellor to ask, the chip tier steps in.
Some facts — age, citizenship — have no school employee to certify them, and some students have no counsellor relationship at all. For that narrow class of claim, the Passport falls back to Self's identity wallet: it reads the NFC chip already embedded in a passport or eligible ID card and produces a zero-knowledge proof of one fact, generated on-device.
Government-issued IDNFC chip
Passport or ICAO-standard biometric ID card. Held to the back of the phone — the chip data never leaves the device.
Ready to scan
Self protocolzk-SNARK
Waiting for scan…
age ≥ 18TRUE
nationality
Only the requested predicate leaves the device. Everything else on the ID stays unread.
This is why it's the fallback tier, not the default: chip-based proof skews toward students who hold a passport or eligible ID in the first place — often the better-resourced households. The counsellor path stays primary because it's the one that works for students who can't produce a government document at all.
Cryptographic inspectorliveclose
Encompass is a concept prototype for an AI Passport ideathon submission. Credential structure follows W3C Verifiable Credentials in SD-JWT VC format with salted-hash selective disclosure; the optional identity-chip tier is modeled on Self (self.xyz), an open-source wallet that generates on-device zero-knowledge proofs from passports and ID cards. All names, districts, and providers shown here are fictional.