chapter sixteen
16 Using verifiable credentials for authorization
This chapter covers
- The challenges that traditional account-based and federated identity models face when authority exists outside the organization
- The ways credentials support portable, cryptographically verifiable claims for authorization decisions
- Establishing trust and confidence in credential-based attributes
- The use of credential presentations in policy evaluation
- Patterns for integrating verifiable credentials with policy-based authorization models, including attribute- and relationship-based methods
As ACME’s collaboration platforms expanded, including the legacy Customer Collaboration system and the newer multi-tenant Customer Collaboration Cloud (C³), they came to support several closely related service areas:
- The traditional customer and project work
- A portal that manufacturers use for managing suppliers
- A clinic-integration API and management system branded ACME Health
- A platform that ACME provides to other companies for supporting their service technicians in the field
These are not standalone products so much as different expressions of the same platform. Each depends on authorization decisions that must be made quickly and consistently, with high assurance, even when the people involved have no accounts in ACME’s internal identity systems.