Identity Assurance Level (IAL)
NIST 800-63A levels describing identity proofing strength. IAL1: self-asserted. IAL2: remote or in-person verification with evidence. IAL3: in-person verification by a trained agent.
IAL is about proofing, not login: it answers "how sure are we this account belongs to a real, specific person" rather than "how strongly did they authenticate". Conflating it with AAL is the common mistake, and it produces systems with hardware keys protecting accounts that were opened with an unverified email. Regulated onboarding, benefits programs, and anything with fraud exposure need both levels stated separately.
See also: AAL, NIST 800-63, identity verification, trusted referee, identity verification vendors, identity proofing
Related on Start with Identity
- GlossaryFederation Assurance Level (FAL)
NIST 800-63C levels describing how strongly a federated login protects the assertion an identity provider (IdP) sends to a relying party (RP). FAL1: the IdP sig
- GlossaryAccount Recovery
The process by which a user regains access after losing their authenticator: a lost device, a forgotten password, or a revoked credential. It is a parallel auth
- GlossaryAge Verification
Age verification is a check that establishes a user's exact age, or that they are over a threshold such as 18, from an authoritative source like a government ID
- BlogHow to vet a national digital ID before you build KYC on it
Not every national ID is equally trustworthy or equally easy to verify. A practical seven-point checklist for evaluating a country's digital ID before you wire
- PodcastState of Identity
Liminal's long-running interview show on the digital identity market, verification, and fraud. 358 episodes, with no new one since May 2024.
- PodcastTrinsic
Trinsic CEO Riley Hughes interviews the people launching identity products: wallets, mobile IDs, verification, and verifiable organisation identity.