A claim is an attribute-bearing statement about a subject, such as an identity attribute, employment status, certification, or authorization. Identity and authorization systems convey claims so policies can evaluate who is requesting access and under what conditions. section 13.3.2 section 16.2
Claims can arrive in OIDC tokens, federated identity exchanges, device signals, or verifiable credentials. A relying system should distinguish stable identifiers and tenant scope from dynamic data that may become stale, such as entitlements or account state. section 13.3.2 section 2.5.2
Authorization commonly handles claims through this path:
- Verify the source, signature, issuer trust, validity, and authorization to make the claim. section 16.2 section 16.6
- Normalize the extracted values into an internal attribute schema, such as employer=AuditsRUs or certification=CISA-R. section 16.6
- Evaluate the resulting attributes with resource metadata, session information, and environmental conditions at decision time. section 16.6
Audit access
An auditor presents a verifiable credential containing an employer, professional role, active employment status, validity period, and revocation status. After verification and normalization, a policy can require employment by a trusted auditing firm or a certification from an accredited authority without depending on the credential’s presentation format. section 16.2 section 16.6
{
"type": ["VerifiableCredential", "EmploymentCredential"],
"issuer": "did:web:auditsrus.example",
"validFrom": "2026-01-10T00:00:00Z",
"validUntil": "2027-01-10T00:00:00Z",
"credentialSubject": {
"id": "did:example:angela",
"employer": "AuditsRUs",
"role": "Security Auditor",
"employmentStatus": "active"
},
"credentialStatus": {
"id": "https://auditsrus.example/status/2026#24519",
"type": "StatusList2021Entry",
"statusPurpose": "revocation",
"statusListIndex": "24519",
"statusListCredential": "https://auditsrus.example/status/2026"
},
"proof": {
"type": "DataIntegrityProof",
"cryptosuite": "eddsa-rdfc-2022",
"created": "2026-01-10T15:22:04Z",
"verificationMethod": "did:web:auditsrus.example#key-1",
"proofPurpose": "assertionMethod",
"proofValue": "z3FXQjC7nYq9...abbreviated..."
}
}
A verifiable credential example shows how issuer, subject claims, validity, revocation status, and cryptographic proof travel together. section 16.2
