Service & Workload quickstart

You operate an enduring service or workload. One Passport is one ENDURING logical service or workload operated by the Parent; never a pod, replica, instance, process or region; provider-neutral continuity.

Law: one logical workload -> one Passport; ephemeral pods/replicas/processes -> nothing; environments/regions/clusters -> bindings.

Never a new Passport: pod, replica, instance, process, deployment_instance, region, cluster, runtime_credential.

Open the Service & Workload door in TrustOps and sign in once. If your organisation has no Business Passport, a free DECLARED one is created. No payment is taken. Have one of these identifiers ready:

• workload_name: stable publisher-scoped logical name, e.g. payments/ledger-writer
• service_origin: the workload's primary origin where one exists
• repository: host/owner/repo of the source repository

Start the Service & Workload Passport in TrustOps ↗ (opens in a new tab)

The families contract names the place: workload manifest / deployment annotation ecz_id + resolver_backlink; trust-graph node workload. A declaration is a pointer, not proof.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: settlement-service
  annotations:
    ecz_id: ECZ-GB-EXAMPL::SERVICE_WORKLOAD_PASSPORT-AB12CD
    resolver_backlink: https://resolver.ecocitizenz.org/p/ECZ-GB-EXAMPL::SERVICE_WORKLOAD_PASSPORT-AB12CD

A binding attaches the Passport to a native identity you control. The binding classes this family defines are: aws_iam_role, gcp_workload_identity, entra_workload_identity, spiffe_id, kubernetes_service_account, oidc_issuer, nvidia_nemo_workflow.

Proof is established through TrustOps and ECZ-ID Core, never on this site. Until a binding is proven, the public record reads binding.state: NO_PUBLIC_PROOF, which is the normal state of a new record. A class being defined is not a claim of a live integration with that provider.

Anyone can check before relying, with no account. This exact command was run on 2026-10-10:

npx -y @ecocitizenz/ecz-id-mcp-verifier check --target docker.io/library/nginx:1.27 --target-type container_image

A public image with no ECZ-ID. One logical workload is one Passport; pods, replicas and processes are never Passports, and environments, regions and clusters are bindings.

• Live · signed inModel what this machine is authorised to do as an ECZ-ID Intent. Carry Intent
• Release-gatedAsk IntentControl for a decision before consequential actions. Request a decision
• No public retrievalPlan for Receipts in your records. Verify a Receipt