Initial Identification of a Company

[boz1]

In our current model, a company fills a claim on the ASCS issuer application and gets a credential issued. While on employee level we can check that request for a credential comes from someone holding a e.g., bmw email, for identifying companies, we can't really rely on this. How can we ensure that it is BMW that requests a credential from ASCS?

Potential Ideas

• Any company joining GX 4 PLC AAD receives a secret and they must provide this when applying for a credential?
• Any company joining GX 4 PLC AAD registers with ASCS and provides a DID that they control