When a supplier employee requests access to a purchase order, credential verification checks whether the presented claims are authentic, trusted, current, and relevant to the requested action. It combines cryptographic proof with issuer authority, governance requirements, expiration, and revocation checks before normalized attributes reach an authorization decision. section 16.10 section 16.8.1
A robust verification flow checks:
- Whether the presentation and credentials satisfy their cryptographic proofs. section 16.10
- Whether the issuer is recognized for the credential type through a trust store and governance rules. section 16.10 section 16.6.2
- Whether the credential remains valid, including expiration and revocation status. section 16.10 section 16.8.1
- Whether verified claims can be normalized into policy attributes without embedding issuer or credential-format details in authorization policies. section 16.6.2
Supplier purchase-order access
A supplier employee presents employment and delegated-authority credentials through OpenID4VP flows. The policy enforcement point verifies the presentation, confirms the supplier is approved, checks that delegation is current, and forwards normalized attributes to the policy decision point. Access is granted only when employment, contract authority, and credential validity all align. section 16.8.1
permit (
principal,
action == Action::Document::"doc:view",
resource
)
when {
resource.sensitivity == "sensitive"
&& principal.certification.type == "CISA-R"
&& principal.certification.issuer in context.trusted_certification_bodies
&& principal.certification.expiry > context.now
};
A policy requires a current certification from a trusted certification body for sensitive documents while keeping issuer knowledge in the trust store rather than policy logic. section 16.6.2
