LoA substantial vs. high: assurance levels in practice
Last updated: · Leutrim Miftaraj
eIDAS defines levels of assurance: substantial and high differ in how strongly the identity was verified. For mandates this is not a formality — it is the dial with which verifiers steer their risk.
In the mandate
Every mandate carries the verification_level of its identity anchor. A verifier can require LoA high through its acceptance policy — mandates at substantial then receive MD-503 (verification_level_insufficient), deterministically and with a reason.
Risk tiers
A common pattern: substantial suffices for booking appointments and managing subscriptions; high for initiating payments, releasing data and actions towards authorities. The risk level of the action taxonomy (1–3) supplies the default mapping.
With a wallet connected
EUDI and E-ID wallets deliver LoA attributes natively — the policy check then passes through state verification instead of running its own identification processes.
Key takeaway
LoA is the language in which verifiers express «how sure am I about this person» by machine — MD-503 is its answer.
Try it yourself
Issue your first agent mandate and check your first decision with its receipt — free, in a few minutes.