A credential verification service checks presented credentials through cryptographic proofs, issuer authority, governance rules, revocation, and expiration before producing trusted attributes for authorization. section 16.10
A mature service typically:
- Accepts presentations from different credential protocols and wallet types. section 16.10
- Checks issuer trust through trust stores while keeping governance decisions separate from authorization policy logic. section 16.10
- Normalizes verified claims into consistent attributes so policies evaluate attributes rather than credential formats. section 16.10
- Provides telemetry and decision logs for monitoring policy outcomes in production. section 16.9.4
Incremental rollout
An organization can begin with external auditors, stabilize presentation flows, revocation endpoints, and issuer trust rules, then extend verification to suppliers, clinicians, and field technicians. section 16.9.4
