The Ten Commandments of Trust.
Ten principles that define what it truly means to be sovereign — presented three ways at once: as commandments (the law), as a Bill of Rights (what you, the person, are owed), and as a litmus test (how to tell a sovereign ally from an extractive wolf). The same ten, seen as law, as rights, and as test.
Prefer the mechanism to the metaphor? Read RosaTrust in plain terms — the practical, assessor-ready companion.
The one question that undresses the wolf
Who actually holds the wallet, the identity, the keys, and the value — the person, or the platform? Saying the right things is free. The wolf is exposed the moment you ask who holds custody.
Two kinds of sovereignty — and the tell between them
Sovereignty by policy: "trust our well-governed institution not to misuse the data it can read." The operator holds the keys; your control is a promise enforced by their governance. Every custodian can be breached, subpoenaed, acquired, or bankrupted — and then the asset it held is someone else's.
Sovereignty by cryptography: the operator cannot read the data at all. Betrayal is mathematically impossible, not merely prohibited.
The wolf offers the first and calls it the second. And "but they have a blockchain" is a red herring: a ledger makes records immutable, but it is orthogonal to the only question that matters — can the operator decrypt without the person's key? An audit trail proves what was done after the fact; it never prevents the custodian from reading.
The Ten
Each commandment is shown as all three instruments: the principle, the right you hold, and the test for any actor — with the wrong it forecloses.
You are your own sovereign root.
Your identity is anchored to you — a unique, real person, proven on your own terms — and you hold its root. Never a state ID, a platform account, or a biometric pool another party holds.
Your right to own the root of your identity, and to be proven real without surrendering a government ID or a permanent biometric to anyone's database.
The test Does the person hold the root, proven by something they control — or is their identity an account on your platform, and their uniqueness something you own?
Forecloses identity you can only rent, that a company or government can revoke, delete, or hold hostage; and the biometric honeypot.
Your data is unreadable, and never leaves you.
Your data is encrypted under a key its custodian can never hold — the operator cannot decrypt it. When it must be used, the computation comes to the data; the record itself never travels. A ledger that records is not a vault that protects.
Your right to a custodian structurally unable to read you, and to have research run on your data where it lives, returning only answers.
The test Is bearer data encrypted under a key the operator never holds, and does computation travel to the data rather than the data to the buyer?
Forecloses the honeypot held in the clear; "trust our well-governed bank"; the audit-trail dressed as sovereignty.
Consent is a living switch — access, never a copy.
Consent opens a scoped, instantly-revocable door to data that stays in your wallet. Authorization is not transfer; revocation is real because nothing escaped.
Your right to grant and withdraw consent in an instant, and to know that "no" ends the access with no copy left behind to outlive your withdrawal.
The test Is consent a cryptographic object that grants revocable access in place — not a hand-over of a copy?
Forecloses consent-as-a-copy: the one-way "I agree" that ships your data and is theirs forever.
You reveal only what you choose.
You prove a single fact — over-18, tier-2, loyal patron — and reveal nothing more.
Your right to prove a predicate without a document dump, surrendering no more than the question requires.
The test Can the person prove one predicate revealing nothing else — no license upload, no full record?
Forecloses the document-upload: the single worst extraction event of online life.
You cannot be correlated.
The identity you present to one party is unlinkable, by default, to the identity you present to another. Correlation does not travel unless you send it.
Your right to be recognized without being tracked: no single identifier that joins every dataset against you.
The test Does each relying party get a per-link identifier that cannot be correlated across parties?
Forecloses the super-cookie of the self: one global ID that lets every dataset be joined behind your back.
You share in the value you create.
When your data creates value — a study, a model, a product — you share in it, as a paid counterparty and stakeholder; and you are never charged to exist or to reach your own data. Value flows to you and to the commons, never extracted from you as raw material.
Your right to a share of the value your data creates, and to never pay to prove you are real or to reach what is yours.
The test Does the person keep the majority of the value and pay nothing to be real or to reach their own data?
Forecloses you as the product: tolled at every proof, handed a token gift while sponsors buy your data.
Verify everywhere, issue nowhere.
Anyone, anywhere, even offline, can confirm that a credential is genuine — against one open root, without asking anyone's permission, and without anyone watching.
Why this one matters — the quiet commandment most people miss. In almost every system today, to check that something is real you must phone home to a central authority — who then sees every check you make, and can refuse it, throttle it, log it, or be breached. This breaks that: verification is stateless, leaks nothing, and phones home to nowhere — so trust can spread across the entire world without creating a single gatekeeper to ask, a single chokepoint to censor, or a single honeypot to breach. No one owns the ability to verify — not even us. Simple, but decisive: miss it, and you have quietly rebuilt the very gatekeeper you set out to escape.
Your right to have your credentials verifiable by anyone, anywhere, offline — beholden to no gatekeeper's permission or surveillance.
The test Can anyone verify offline against one open root, with no central service watching or able to say no — so no single party, not even you, is the gatekeeper?
Forecloses the proprietary silo and the surveillance chokepoint: the one registry, ministry, or vendor everyone must ask, that sees every question.
Nothing of yours depends on any one party.
You can leave with your keys, credentials, receipts, and vault, verifying offline; if any party — including us — vanished tonight, your sovereignty stands.
Your right to walk away with everything intact, and to a sovereignty that survives the failure or exit of any single party, including the one that built it.
The test If your service vanished tonight, does anything of the person's stop issuing, verifying, revoking, or anchoring? Can they exit with no exit tax?
Forecloses partner-as-substrate: dependency dressed as partnership; and the exit tax.
Every machine is a sovereign, accountable principal.
Every AI that reads or acts on your data carries its own sovereign, attested identity — accountable to a named human, cryptographically distinguishable from a person, and bound to the consent it was granted. It can never present as human.
Your right to know that every automated actor touching your data is accountable, attested, never disguised as a person, and answerable to someone real.
The test Does every AI or automated actor operate under an attested, owner-accountable, never-human identity bound to the consent it was granted?
Forecloses the unaccountable agent mining your most intimate data with no name, no consent-binding, and no one to answer.
Your sovereignty endures.
These rights cannot be waived in fine print or contracted away; they survive every technology beneath them; and they pass to your heirs. Sovereignty through your life — and beyond it.
Your right to a sovereignty no terms-of-service can strip, that outlasts the tools that implement it, and that passes to those you designate when you are gone.
The test Are these guarantees inalienable — un-waivable as a condition of service — and does the person's sovereignty survive their death, passing to their heirs?
Forecloses the fine-print surrender (rights that exist until you click "I agree"); and the estate seized by default when you die.
The standard is a wall, not a scorecard
Fail even one of these ten, and you are — by design — extractive.
These are indivisible. You do not "pass on balance." Get nine right and still hold the keys (fail II) — you still hold the keys. Get nine right and pay nothing back (fail VI) — the person is still your product. Get nine right and become the substrate (fail VIII) — everyone still depends on you.
Sovereignty is not a score; it is a wall. One breach, and the wall is down. That is what makes this a standard and not a marketing checklist.
How to read a party
The litmus test, as three verdicts — patterns, not a hit list. The allies matter as much as the wolves.
Sovereign — combine
Passes all ten. Or holds custody and is missing only payment or personhood — a true ally whose gap is our wedge, not a broken principle.
Partial — interop, watch
Clean rails, but the person holds nothing yet. Useful as a carrier or component — never as substrate.
Extractive — route around
Fails one or more. However sincere the team or clean the story, the wall is breached. The wolf.
Why these are the right ten — and not someone's opinion
The limiter is our own invariants and our own law, not an undefined third party's classifier. Each of the ten descends from a rule we hold and can point to — and each maps, one-to-one, onto both the Sovereign Health Data Bill of Rights and the IEEE 2874 profile. When three independent instruments converge on the same ten, that is not a preference; it is a standard.
And the ally test has a shape. A party may be a peer, a carrier, a witness, an attester, or a distribution channel — never our substrate:
PEER · CARRIER · WITNESS · ATTESTER · CHANNEL — never SUBSTRATE
The opening — our call to arms
The wolves are not a warning. They are the proof.
Every party racing at this validates the same thing: the demand for sovereignty is real, urgent, and worth a fortune. And nearly every one of them ships the transitional form — a custodial bank, a biometric pool, a centralized wallet — because the real thing is hard. The durable form — sovereignty by cryptography, with the value flowing back to the person — is unbuilt by anyone but us.
We hold the axes no one else combines: the architecture allies give the person custody but not payment; the banks and brokers have the go-to-market but not the custody. All ten, together, is ours — and the field is empty. And the extractive model is straining in public — consumer-genomics bankruptcies, billion-dollar genetic-privacy suits, data-brokers under regulatory fire. The door is open now.
The charge
This is not a defensive scorecard — it is an accelerant. The wolves proved the market and left the real thing unbuilt. We have the protocol, the intelligence layer, the standard, the settlement rail, and the only sovereignty that is a proof, not a promise. Let us galvanize behind the true Trust Society and the Generous Economy — and build it while they ship costumes.
This is our own standard, measured against our own invariants — one canon expressed as law, as rights, and as a test, and cross-walked against the Sovereign Health Data Bill of Rights and the IEEE 2874 profile. We hold ourselves to all ten: if RosaTrust vanished tonight, a person's identity, keys, vault, and receipts still verify — because they were always theirs. Sovereign by construction, generous by design.
The Ten Commandments of Trust — the standard we hold everyone to, including ourselves.
The working stack is live today — Rosalind (sovereign health) · Abakus and its Foundation (sovereign banking) · RosaTrust (the trust engine underneath it all).
Owned by no one · anyone can verify it · no lock-in, ever.