Trust Scoring

The score field in an AiHint document represents a trust assessment of the target domain, expressed as a number from 0.0 (no trust) to 1.0 (full trust).

This page explains what the score means, how it can be calculated, and how AI systems should interpret it.

What the Score Represents

The trust score is a single numeric summary of how trustworthy a domain is, based on the scoring methodology identified in the method field. It is not a guarantee — it is a signal that AI systems can factor into their decision-making alongside other information.

The score is always:

• Issuer-specific: Different issuers may assign different scores to the same domain, based on their own criteria.
• Method-specific: The method field identifies which scoring methodology was used, allowing consumers to weight scores accordingly.
• Time-bound: Scores are valid only between issued_at and expires_at.

Trust Levels

While the score is a continuous value, it can be interpreted using these general trust levels:

Score Range	Level	Description
0.90–1.00	Very High	Comprehensive verification passed. Strong trust signals across all categories.
0.70–0.89	High	Most verification checks passed. Minor gaps in trust signals.
0.50–0.69	Medium	Basic verification passed. Some trust signals present but incomplete.
0.30–0.49	Low	Limited verification. Few trust signals detected.
0.00–0.29	Very Low	Minimal or no verification. Significant trust concerns.

Scoring Methodology

The AiHint standard does not mandate a specific scoring algorithm. The method field identifies which methodology was used, so consumers can evaluate scores in context.

However, a reference scoring methodology — aihint-core-v1 — evaluates domains across multiple signal categories:

Signal Categories

Category	What It Measures
SSL/TLS	Certificate validity, strength, and configuration
Security Headers	Presence and correctness of HTTP security headers (CSP, HSTS, X-Frame-Options, etc.)
Domain Reputation	Domain age, registration history, DNS configuration
Privacy	Presence of a privacy policy, GDPR compliance signals
Contact Information	Availability of contact details, business registration info
Content Quality	Page structure, accessibility, content coherence
Malware / Blocklists	Whether the domain appears on known malware or phishing blocklists

Scoring Phases

The reference methodology uses a three-phase approach:

1. Data Collection — Automated analysis gathers raw signals from the target domain (HTTP responses, DNS records, page content, certificate info, third-party databases).

2. Signal Scoring — Each signal category produces a sub-score from 0.0 to 1.0 based on predefined criteria.

3. Aggregation — Sub-scores are combined using weighted averaging into a single final score. Weights reflect the relative importance of each category to overall trust.

How AI Systems Should Use the Score

Recommended Practices

• Check expiration first: If expires_at is in the past, discard the hint and attempt to fetch a fresh one.
• Verify the signature: An unverified score should not be trusted. Always verify the signature before using the score.
• Consider the issuer: A score from a well-known issuer carries more weight than a self-signed score.
• Use as one signal among many: The trust score is an input to decision-making, not a final verdict.

What the Score is NOT

• Not a safety guarantee — A high score does not mean the site is safe for all purposes.
• Not permanent — Scores expire and can change when re-evaluated.
• Not universally comparable — Scores from different issuers using different methods are not directly comparable.

Self-Signed vs. Issuer-Signed Scores

Type	Use Case	Trust Implication
Self-signed	Development, testing, private use	Score reflects the site owner's own assessment. No third-party validation.
Issuer-signed	Production, public-facing	Score reflects an independent third-party assessment. Verifiable via the issuer's public key.

Self-signed hints are valid according to the protocol but carry no third-party trust. AI systems may choose to weight them differently.

Next Steps

• Protocol Specification — Full field reference
• Security Model — How the trust model handles adversarial scenarios
• Implement AiHint — Deploy a hint on your domain