Itz'at is the credential standard behind Miatz Certify: a signed, revocable, machine-readable credential that a stranger — or their AI agent — can check in seconds without asking us for permission.
A PDF certificate asserts. An Itz'at carries the material a reader needs to test the assertion themselves.
The credential is signed under the issuing organisation's own did:web. Their name is on it; miatz operates the machinery. That is the opposite of a platform badge.
A hashed email binds the credential to a person, or the holder's own DID when they present from a wallet. The raw address never travels inside the credential.
The name of what was earned, the criteria that had to be met, the exam blueprint it aligns to, and a link to the evidence. A reader can see what the bar actually was.
validFrom and validUntil for expiry, plus a credentialStatus entry pointing at one slot in a Bitstring Status List. Revoking or expiring flips a single bit — no takedown request, no email chain.
A Data Integrity proof (eddsa-rdfc-2022) over the whole credential. A VC-JWT export is available for systems that are already JWT-native. Tamper with one character and the proof fails.
Alongside the issuer's signature sits a miatz-issued EndorsementCredential over that issuer: a second, independent signature attesting they are a verified Itz'at member operating under the scheme's governance.
The same credential, as a machine reads it:
{
"type": ["VerifiableCredential", "OpenBadgeCredential"],
"issuer": "did:web:creds.example.com",
"credentialSubject": {
"id": "did:example:holder",
"achievement": {
"name": "Example Certified Developer",
"criteria": { "narrative": "Passed blueprint EX-200, 78/100 cut score" },
"alignment": [ /* exam blueprint domains */ ]
}
},
"validFrom": "2026-07-23",
"validUntil": "2028-07-23",
"credentialStatus": {
"type": "BitstringStatusListEntry",
"statusListIndex": "94567"
},
"proof": { "cryptosuite": "eddsa-rdfc-2022", "proofValue": "z58…" }
}Illustrative shape, trimmed for reading. The miatz EndorsementCredential over the issuer is a second, separately signed document.
Every Itz'at verification — by a hiring manager, a partner portal, or an AI agent running the checks itself — is these three steps in this order.
Read the DIDs named in the credential and fetch their DID documents over HTTPS — the issuer's own domain, plus did:web:creds.miatz.com for the endorsement. Public keys can be cached or pinned.
The issuer's signature proves authorship of the achievement. The miatz endorsement proves the issuer is inside the Itz'at scheme. Two independent keys, two independent checks.
Fetch the Bitstring Status List named by credentialStatus and read the one bit for this credential. Set means revoked or expired. The list covers many credentials at once, so reading it reveals nothing about who is asking.
None of those three steps calls a miatz API. That is deliberate: a credential whose validity depends on its vendor still being in business is not a credential, it is a subscription.
A4 is the top of the closed assurance vocabulary — and the only level that is never for sale.
The vocabulary is closed — nobody may add a level or reword one. Definitions
Every layer of an Itz'at is an open, published specification. We wrote none of them, which is exactly why they are worth building on.
| Standard | What it does here | Status |
|---|---|---|
| Open Badges 3.0 | The credential format. EndorsementCredential is a native OB 3.0 construct — the Itz'at mark is not a bolt-on. | Committed |
| W3C VC 2.0 | Open Badges 3.0 is a W3C Verifiable Credential, so any conformant VC verifier reads it. Data Integrity proofs plus VC-JWT export. | Committed |
| Bitstring Status List | Revocation and expiry as one bit in a large shared list — checkable without telling the issuer which credential you looked up. | Committed |
| did:web | Issuer identity anchored in DNS the issuer already controls. Key rotation is a change to a JSON file they publish. | Committed |
| eddsa-rdfc-2022 | The Ed25519 Data Integrity cryptosuite used for the signature itself. | Committed |
| OpenID4VCI | Wallet delivery, so a holder can keep an Itz'at in a credential wallet rather than a folder of PDFs. | Roadmap |
“Committed” means it is the specification Miatz Certify is being built against and the shape every issued Itz'at will take. “Roadmap” means planned and not yet live — we would rather say that plainly than let a spec logo imply something we have not shipped.
AI-fluency scores in the Itz'at family are computed against this rubric — from observed real work plus periodic oral vivas, never from a multiple-choice test alone. We publish it because a bar you can't read isn't a bar.
| Dimension | What it measures |
|---|---|
| A · Delegation | Choosing what to hand to AI — and what not to; agent-vs-chat fit for the task. |
| B · Description | Goals, context, constraints and success criteria stated; work decomposed into checkable pieces. |
| C · Discernment | Verifying output before adopting it: running it, tracing claims, testing — not vibes. |
| D · Diligence | Security, IP and privacy hygiene; honest disclosure of AI involvement. |
| E · Iteration craft | Refining with intent vs blind retrying; knowing when to restart from scratch. |
| F · Tool leverage | Using skills, agents, MCP and multiple models where they genuinely help. |
| G · Economy | Model choice, token and cost awareness — engineering judgment applied to spend. |
| H · Groundedness | Blast-radius thinking before delegation; signing the deed; knowing when NOT to use AI. |
| T · Thinking (Tuukul) | Calibration (stated confidence vs actual outcomes), gate discipline, premortems, reflection streaks. |
Professional-level Itz'at AI-Fluency cannot be earned without the H and T strands — observed consequence-awareness and calibrated thinking from real work. Every rendered score carries a “how computed” note; estimates are labeled and missing data is never shown as zero. The T-strand is trained by Miatz Tuukul.
Issuers white-label everything a learner sees. The verification surfaces are the one exception, and the mark on them is backed by a signature rather than a style guide.
The mark corresponds to a real EndorsementCredential signed by miatz over the issuer. A verifier can check it independently, which is what separates a trust mark from a logo anyone could paste on.
Verify page, share link, QR code, PDF — the mark appears on every surface a stranger might land on, so the question “who stands behind this?” is answered wherever the credential is read.
The endorsement attests that the issuer is identity-checked, that their exam scheme was reviewed, and which integrity tier the exam ran at. It does not claim miatz taught the course or graded the candidate.
No Itz'at has been issued — not to a cohort graduate, not to a tenant's candidate. Issuance stays switched off until the signing key is in custody and creds.miatz.com and verify.miatz.com serve the DID documents and status lists over TLS. A signed record a stranger cannot resolve is worse than no record, so we would rather owe you one.
The full standard described on this page — per-issuer did:web signing, Open Badges 3.0 / W3C VC 2.0 output, Bitstring Status List revocation and the miatz endorsement co-signature — is the committed architecture of Miatz Certify and is being built now. Wallet delivery follows it.
We publish the target before it ships because organisations choosing a credential vendor need to know what they are being locked into. In this case: as little as we could arrange.
Itz'at is miatz's credential standard and trust mark: an Open Badges 3.0 / W3C VC 2.0 credential signed under the issuing organisation's own did:web, revocable through a Bitstring Status List, and co-signed by miatz as a member of the scheme. Issuance is not open yet — see "Where this is today" for what has to land before the first one is signed.
Nothing technical, in the simple case: open the hosted verify page or scan the QR and read the live result. If they want to verify it themselves, they resolve two DID documents, check two signatures and read one status bit — no account and no miatz API call required.
That is the design goal of choosing these standards: the signature, the DID documents and the status list are public artifacts on ordinary web infrastructure, and a verifier that cached the issuer's key can check a credential offline. The honest caveat: the key-custody and mirroring commitments that turn that architecture into a guarantee are still being written down — until they are published, treat this as design intent rather than a promise.
Both, and they mean different things. The issuing organisation signs the achievement: they are the authority on what their exam tested. Miatz signs an endorsement over that issuer: identity-checked, scheme-reviewed, integrity tier disclosed. A verifier can accept one, the other, or insist on both.
Same standard, one issuer. When issuance opens, a miatz cohort graduate's Itz'at will be signed by miatz itself under the same format and the same verification path any tenant gets — none has been issued yet. How a learner earns one — the gates, the auditable record — is explained on the credential page.
It is not a formal academic qualification and does not present itself as one. It is a professional credential that says a named person met a published, evidence-backed bar on a named date, and it hands any reader the means to check that claim independently.
Everything else is theirs: their domain, their DID, their branding on the certificate and the academy. The verification surfaces are the exception — the verify page, link, QR and PDF always carry "Itz'at · Verified by miatz", because that is the part a stranger is being asked to trust.
The fastest way to understand the standard is to earn one. Sit Chuun, get placed in the curriculum, and your first Itz'at is signed under this exact standard the day issuance opens.
From the guides: what the Itz'at records and how verification works, how the public profile carries it, and the mastery gates behind both.
The shareable proof you leave with.
Read the guideOpt in to a public, employer-checkable profile — and how signed credential links verify.
Read the guideHow exams are graded and how you advance.
Read the guideIf your product certifies anyone — customers, partners, developers, staff — Itz'at lets you issue under your own domain and your own key, with a verification path that outlives the vendor relationship.