What Is a SIBUID?

A SIBUID is a unique identifier used to distinguish a defined software-identity binding within the continuity boundary established by a system's policy.

The definition is intentionally independent of any particular protocol, credential format, attestation architecture, registry, cryptographic representation, or standards body.

Software

Software means an executable or operational software actor capable of being identified in a computing environment.

Identity

An identity provides a stable way to refer to a software actor within a defined system or trust context.

An identity can answer Which actor is this? It does not necessarily answer which key represents it, which build is operating, which runtime is executing it, which authority applies, or which evidence supports its present state.

Those facts can be associated with the identity through other mechanisms. That association is the binding.

Binding

A software-identity binding is a defined association between a software identity and one or more properties that give that identity operational meaning for a particular purpose.

Unique

Unique means that the identifier distinguishes the binding within the namespace in which it is used.

Uniqueness does not imply a globally centralized registry and does not prescribe a UUID, URI, DID, hash, database key, transparency-log identifier, or another representation.

Identifier

The identifier is the value through which the software-identity binding can be referred to unambiguously within its intended context.

Software actor
    ↓
Software identity
    ↓
Software-identity binding
    ↓
SIBUID

A separate identifier can name an exact snapshot, statement, attestation, record, or document associated with that binding. The binding identifier and the snapshot identifier are not necessarily the same value.

The three identity levels

One actor can have more than one binding

Software Identity: service-7821
│
├── Production binding
├── Staging binding
├── Customer-delegated binding
└── Recovery binding

Each can have different keys, software state, environments, authority, evidence, or validity conditions. If those bindings need to be distinguished independently, each can have its own SIBUID.

Continuity delimits the binding

The term SIBUID does not universally decide whether an identifier should survive a change. A system first defines a continuity policy: the rules that determine which state transitions remain inside the same binding and which cross into a new binding.

A SIBUID identifies a binding as delimited by a continuity policy.

Whether a SIBUID persists across an authorized change, or a new one is assigned, is a policy question. This reference does not impose one universal answer. It names the question.

Semantic role, not wire format

SIBUID does not define authentication, authorization, attestation, credential issuance, transparency logging, key management, workload identity, or cryptographic proof formats.

Existing and future systems may provide those functions. A SIBUID can be implemented using identifiers already available in those systems when they are suitable for identifying the intended binding.

SIBUID is a semantic designation before it is an implementation choice.