Transport trust is not actor trust
Certificates prove who is on the wire. They do not prove who is allowed to ask, or why. What trusted exchange frameworks still leave to governance.
Nationwide trusted exchange has solved a problem that stalled interoperability for fifteen years: a single trust fabric, a common agreement and a standard way to find and request records across organizational boundaries. The engineering under it is sound. Participants are identified by strong cryptographic credentials, every transaction is secured, and the network can tell with confidence which organization sent a given request.
What the network cannot tell, at the moment a request arrives, is whether that organization was entitled to make it. Eligibility to participate is established through onboarding and attestation. The purpose of a request is asserted by the requester. Obligations are strongest at the top tier of the network and thin out below it. The trust architecture is therefore asymmetric: transport-layer trust is strong and verified per transaction, while actor-level trust is largely self-declared and verified, if at all, well after the fact.
Why this is a governance problem, not a bug
This is not a design flaw to be patched. Any framework that scales to thousands of organizations has to rely on attestation somewhere; the alternative is a central authority adjudicating every request. The consequence, though, is that the work of making trust real moves from the network to its participants. The gaps are specific: independent verification of who participants and sub-participants actually are, standardized transaction-level monitoring so anomalies are visible, security obligations that reach beyond the top tier, operational accuracy standards for the responses that flow back, and some check on exchange-purpose assertions beyond the assertion itself.
What participants should do about it
An organization joining a trusted exchange should design for the gaps rather than assume the framework closed them. That means treating audit logging as a product requirement, with every request and release recorded in a standard, queryable form. It means monitoring exchange activity for patterns that an attestation would never surface. It means being deliberate about which exchange purposes you will honor and how you will evaluate requests under each. And it means being able to demonstrate, to a regulator or a patient, that your participation is trustworthy rather than merely attested.
Trusted exchange is the right direction. The organizations that benefit most from it will be the ones that understood where the framework's trust ends and their own governance has to begin.