A worked example of forward-only credential activation, student-controlled multi-tier disclosure, and FERPA-aligned access architecture in the educational records variant of the ABT methodology family.
The ABT-E variant applies the foundational envelope-tier architecture to educational records, with a university degree credential as the canonical scenario. The variant-specific architectural elements are: forward-only activation, such that a credential once issued and recorded in the hash-chained registry cannot be retracted by any subsequent institutional action; student-controlled three-tier disclosure, in which the student separately authorizes degree verification, full transcript release, and aggregate research contribution — each projection scoped to its recipient and purpose; and aggregate research isolation, in which the research tier contains cohort statistics with no individual student PII. This memorandum follows Nadia Volkov's credential from issuance through employer verification, graduate school transcript release, aggregate research use, and an institutional retraction attempt.
The issuance event is recorded in the registry's hash chain. This is the moment of forward-only activation: the hash chain entry cannot be removed, expunged, or altered without breaking chain integrity. The credential's existence is cryptographically proven from the time of this entry.
Volkov authorizes a degree-tier projection for employment verification. The employer receives: degree confirmed, GPA, graduation year. The employer does not receive individual course grades, failed attempts, or any other transcript content.
Traditional employment verification has typically been transacted through institutional verification services — the employer contacts the institution, which confirms or denies the credential. ABT-E inverts this: the student controls the verification projection. The institution's role in individual verification is eliminated; the student's credential envelope contains the verifiable projection, authenticated by the institutional signing key embedded at issuance.
The employer-facing degree tier contains: degree title, field, institution, year, and GPA. It does not contain course-level grades. An employer who requests transcript-level detail is requesting a separate consent event — not a superset of the degree verification projection.
Volkov authorizes the transcript tier for a graduate school application. This is a separately scoped consent event: full course history, grades, and academic standing are included. The employer projection and this transcript projection are independent events with no shared fields.
Meridian University attempts to mark Volkov's credential as invalid following an institutional dispute about the 2025 graduating class. The hash chain prevents factual erasure of the issuance event.
The institution may append a dispute annotation to the registry record. That annotation is itself hash-chained and publicly visible. What the institution cannot do is delete or alter the original issuance hash chain entry — h_n — which was computed at the moment of degree award from the envelope content and the prior chain state.
Any verification of Volkov's credential against the registry will show: (1) the issuance event at 2025-06-15, authenticated by Meridian University's institutional signing key; and (2) if present, the institution's dispute annotation. Both facts are visible. Neither can be made to disappear. The credential's existence is proven; the dispute's existence is also proven.
| Property | Guarantee | Legal relevance |
|---|---|---|
| Forward-only issuance | Hash chain entry for credential issuance cannot be removed or altered after recording | Prevents institutional erasure of credential fact; preserves evidentiary record of issuance independent of institutional status |
| Student-controlled projection | Each disclosure (employer, graduate school, research) requires a separately authorized student projection | Structural FERPA consent enforcement; each disclosure is a distinct consent event with auditable authorization |
| Cross-disclosure isolation | Employer and graduate school projections share no common field; neither recipient knows of the other | Purpose limitation enforced structurally; no cross-disclosure aggregation by recipients |
| Aggregate research isolation | Research tier contains cohort statistics; no individual student PII is accessible to research function | FERPA's research exception (§ 99.31(a)(6)) is satisfied structurally rather than by policy waiver |
| Dispute annotation model | Institutions append disputes; they do not delete issuance events | Both issuance and dispute are publicly visible; dispute does not prevent student from presenting credential with the historical issuance record |