When an external person requests access, an attribute query asks for the specific claims needed to make that authorization decision—not for a particular credential. A policy enforcement point (PEP) derives the query from the applicable policy, and the holder’s wallet selects claims from one or more credentials. The result is a signed presentation containing only the required information. section 16.5
Figure 16.3 Claim-based credential presentation. Upon receiving an access request, the PEP requests the specific attributes it needs for the authorization decision. The holder’s wallet receives the attribute query, selects the necessary claims from one or more credentials, and assembles a signed presentation. The PEP verifies the presentation and prepares the claims for policy evaluation.
The flow shows the PEP requesting attributes, the wallet assembling a presentation, and the verification layer preparing claims for policy evaluation. section 16.5
An attribute query supports authorization that adapts to the request and business relationship:
- Requests only relevant claims, such as an employer and certification status, rather than requiring a fixed credential. section 16.5
- Combines claims from different credentials while preserving issuer binding and confirming that they belong to the holder’s wallet. section 16.5
- Checks supplier employment and delegated contract authority before allowing access to a purchase order. section 16.8.1
- Requests tenant, project, and role claims so policies can distinguish owners, contributors, reviewers, and finance approvers. section 16.8.4
