16 Using verifiable credentials for authorization

The chapter explains how verifiable credentials let ACME authorize people whose important attributes are controlled by organizations outside ACME, such as employers, licensors, clinics, suppliers, and project owners. Traditional internal accounts and federation work well for employees or a few established partners, but they become awkward, costly, and incomplete when access depends on external facts that ACME cannot authoritatively maintain itself. Verifiable credentials solve this by carrying portable, cryptographically signed claims about roles, qualifications, delegations, and relationships, allowing ACME to make fast, high-assurance decisions without creating or synchronizing accounts for every outside participant.

At the core of the approach is a trust model: ACME must trust both the issuer’s authority and the freshness of the credential. The holder stores and presents the credential, but ACME verifies signatures, revocation status, expiration, and whether the issuer is trusted for that specific claim type. That trust is managed through governance and a trust store, which records which issuers are accepted for which credential kinds. In practice, a policy enforcement point requests the needed attributes, the wallet assembles a presentation from one or more credentials, and the policy decision point evaluates normalized claims rather than raw credential formats, keeping authorization logic stable and separate from verification details.

The chapter shows how this pattern scales across ACME’s products, including supplier portals, healthcare integrations, field technician workflows, and multi-tenant collaboration spaces. In each case, credentials replace fragile account provisioning with scoped, role-based, and time-bound authorization that naturally follows real business relationships. The chapter also stresses operational discipline: choose credential-based authorization where external authority, frequent turnover, multi-organization trust, or high assurance make it valuable; handle failures with fallback procedures; and roll out incrementally, starting with narrow use cases. The result is a more flexible, privacy-preserving, and maintainable authorization architecture.

The verifiable credential trust triangle. The issuer, AuditsRUs, creates and signs the credential. The holder, Angela, carries and presents it. ACME verifies the signature and uses the data in the credential as context when it evaluates policy.

The trust diamond. The governance authority (NISA) establishes the rules for issuing and verifying security-auditor credentials. NISA grants an accreditation credential to AuditsRUs and publishes a governance framework. ACME consults that framework to decide which issuers it should trust and for which purposes. The verifier’s trust in the issuer is based on the governance authority’s rules, not on the credential holder.

Claim-based credential presentation. Upon receiving an access request, the PEP requests the specific attributes it needs for the authorization decision. The holder’s wallet receives the attribute query, selects the necessary claims from one or more credentials, and assembles a signed presentation. The PEP verifies the presentation and prepares the claims for policy evaluation.

• Verifiable credentials offer portable claims that can be confirmed cryptographically and serve as trusted context in authorization decisions.
• Credential verification establishes confidence through cryptographic proofs and trust through the evaluation of issuer authority and governance frameworks.
• Presentation protocols enable holders to respond selectively to attribute requests, supporting privacy-preserving access decisions.
• The trust triangle and trust diamond models explain how issuers, holders, verifiers, and governance authorities create end-to-end assurance.
• Trust stores track the issuers recognized for specific credential types, distinguishing governance from policy logic.
• Revocation and expiration checks ensure that credential-based attributes stay current and valid when making decisions.
• Verification services can be built to accept presentations from various credential protocols and wallet types.
• Normalizing credential claims into consistent attributes simplifies authorization policies and decouples them from credential formats.
• Policies evaluate attributes, not credentials, enabling new issuers or credential types to be added without modifying policy logic.
• Credential-based access is particularly useful when authority resides outside the relying system or when participants frequently change.
• Exception workflows can allow controlled access when presentations are incomplete or credential requirements are not met.
• Incremental adoption, beginning with narrow, well-governed use cases, reduces operational risk and builds confidence in credential-based authorization.

FAQ