Attributes don’t get exposed — they get turned into proofs.

Each descriptor specifies:

• what proof templates it can feed
• allowed transformations (e.g. >=, <=, equality)
• required issuer rules

Example descriptor entry:

{
  "id": "identity.birthdate",
  "proofable_as": ["age_check"],
  "transformations": ["greater_equal", "less_equal"],
  "datatype": "date"
}

The Proof Engine uses:

• the encrypted value (Vault)
• the descriptor rules
• proof template rules
• commitment path
• zero-knowledge (or GC/MPC) execution

To generate a statement like:

“User is over 18”

(without revealing birthdate)