When an authorization system needs evidence about a person or organization, a credential presentation protocol lets the holder answer an attribute request without handing over an entire credential. The verifier checks the presentation, issuer authority, governance, freshness, revocation, and expiration before trusted claims reach the authorization decision. section 16.10 section 16.9.3
A credential presentation protocol defines how holders respond to verifier requests and transport signed claims. It operates alongside issuance protocols and wallet standards: issuance creates credentials, wallets store and protect them, and presentation supplies selected claims for verification. section 16.7
A typical authorization flow separates presentation handling from policy evaluation:
- The policy enforcement point (PEP) requests the attributes needed for an access decision. section 16.7
- The holder assembles a presentation, potentially selecting only the requested attributes. section 16.10
- The verifier checks signatures, trusted issuers, revocation, expiration, and freshness, then normalizes verified claims. section 16.9.3
- The policy decision point (PDP) evaluates normalized attributes rather than credential formats, issuer identifiers, or protocol constructs. section 16.10
Protocol-independent verification at ACME
ACME accepts presentations delivered through multiple credential protocols and wallet types. Its verification process remains consistent: validate the signed presentation, confirm that claims come from trusted issuers, check current validity, and pass normalized attributes to authorization policies. Adding issuers or credential types therefore need not require rewriting policy logic or application code. section 16.7 section 16.9.3
