| Configuration | What the state gets | What remains open |
|---|---|---|
| VIDA alone | Holder-controlled credentials, verification before collection, no phone-home, purpose sequestration and a prohibition on government population golden records in identity systems. | No general fiduciary relationship, private right of action or AI governance. Note that VIDA relies on PDTA for its transition, oversight and remedies framework, so a VIDA-only state must supply those provisions. |
| VIDA and PDTA | The identity architecture plus the fiduciary relationship: four duties, presumptively and per se disloyal practices, burdens of proof, the Data Trusteeship Authority and a private right of action. | AI, inference and automated decisions are covered by PDTA's general duties but without GAAFA's specific requirements for explanation, contestability, analytics and agentic systems. |
| All three | Identity, the data relationship and computational power governed by one authority model, one oversight body and one transition framework. | Nothing in the framework's scope. This is the recommended configuration. |
Why the layers depend on each other
VIDA is the foundation because no fiduciary duty can be enforced against a system whose architecture makes violations invisible. PDTA is the legal superstructure because architectural compliance without enforceable duties depends on continuing administrative will. GAAFA closes the gap that opens as soon as software can correlate and infer across lawful sources.
In Version 2.2 the three acts share a single transition spine (PDTA Section 28), a single oversight body (the Data Trusteeship Authority, PDTA Section 23) and a single authority model (PDTA Section 24(c)). Enacting them together avoids drafting those shared provisions three times.
States with SEDI-model identity law
A state that has enacted legislation modeled on Utah's SEDI statutes has already built much of VIDA's identity layer. For such a state, PDTA and GAAFA are the natural next steps. See how the framework builds on SEDI.