Atomize information for principle of least authority

[msporny]

We should include information in the spec that states that when issuing information, one should issue it in the smallest pieces possible. When requesting information, only ask for the data points that you need. Issue abstract claims alongside actual data when possible.

[talltree]

Manu, what do you mean by "issue abstract claims alongside actual data"?

[dlongley]

@talltree, I would guess that means when issuing, for example, a Passport credential with a birthdate (actual data), also issue a Proof of Age credential with an "age over 21" abstract claim.

[David-Chadwick]

Perhaps the spec should go even further than this, and say that when issuing credentials, if it not technically possible for the user to selectively reveal single attributes (claims) from the credential, then the issuer should issue a set of credentials, each credential containing a single attribute (claim) only. The user may then aggregate these as necessary and as required by the inspector

[msporny]

@David-Chadwick Yes, we will want to make a note of that in the privacy section.