EVP as an identity layer for explicit email permission?

[Damian Saez]

Hi everyone,

I'm currently implementing the EVP origin trial in a real signup flow at LMGram Partners, and while working through the protocol it led us to an adjacent use case that I'd be very interested to get feedback on.

My understanding of EVP's assertion is essentially:

This user controls this email address.

We've been working on a separate draft protocol called XCIM (eXplicit Consent-Identified Mail) that tries to answer a different question:

Did this independently verified recipient explicitly authorize this application to send a defined category of email?

The idea is not to extend EVP itself with marketing or transactional-consent semantics. Instead, we're exploring using EVP as an Identity Evidence layer underneath a separate consent-attestation flow.

Conceptually:

1. EVP verifies control of us...@example.com

2. Independent XCIM consent service presents a specific permission manifest 

3. User explicitly grants/declines: - account / transactional communication - newsletter - promotions - etc.

5. Portable signed permission receipt with revocation/current-state semantics

We originally used OIDC for the identity layer, but EVP seems substantially cleaner for this use case because it can establish control of the address without requiring every sender to create OAuth clients or forcing another sign-in flow.

The distinction we're trying to preserve is that EVP verifies the address. XCIM attests the permission.

The longer-term motivation is that an ESP receiving a customer list could verify independently which recipients actually granted permission, rather than relying only on consent records produced by the sender itself. The same receipt could potentially remain portable across ESP migrations and carry revocation state.

The current XCIM draft is here:

https://xcim.org/

Network / verification model:

https://xcim.net/

We're still very early (draft v0.1 / experimental), and I'm specifically interested in whether this use of EVP fits its intended trust and privacy model.

Two questions in particular:

1. Does using EVP as the identity-evidence primitive for a separate communication-permission attestation seem compatible with EVP's intended model?

2. Do you see any issue with the EVP verifier being an independent hosted consent service, rather than the application that will ultimately send the email?

I'm implementing EVP first in LMGram so we can understand the actual browser/provider behavior before making it a dependency of the XCIM reference implementation.

Would really appreciate any architectural concerns or edge cases we may be missing.