A credential can remain cryptographically valid while no longer representing current reality. An expiration date records the point after which a document or credential should no longer be accepted for its intended purpose, providing a predictable limit on use. section 16.4
Fixed validity and unexpected change
An employment credential issued to Angela may remain valid for one year before normal HR reissuance. If Brian leaves AuditsRUs before his credential expires, the issuer must revoke it; expiration alone cannot handle that early change. section 16.4
Expiration dates support authorization decisions, but they work alongside freshness and revocation controls:
- Set a predictable maximum validity period for credentials and documents. section 16.4
- Check issuer-published revocation information when a credential becomes invalid before its expiration date. section 16.4
- Balance validity and freshness requirements against operational cost when authorization depends on changing signals. section 12.4.2 section 12.4.4



