An issuer is the organization that creates a verifiable credential, states claims about its subject, and signs the credential. Its signature lets a verifier confirm that the credential has not been altered and identify who made the claims. An employer might assert employment status; a certification body might assert a professional qualification. section 16.2 section 16.2.1
A valid signature is not enough to make a claim acceptable. Cryptography establishes that a credential is genuine and attributable to an issuer; trust depends on whether that issuer has authority to make this particular kind of claim. That authority is assessed through governance rules, accreditation, and organizational review rather than through the holder presenting the credential. section 16.3 section 16.2.1
{
"type": ["VerifiableCredential", "EmploymentCredential"],
"issuer": "did:web:auditsrus.example",
"validFrom": "2026-01-10T00:00:00Z",
"validUntil": "2027-01-10T00:00:00Z",
"credentialSubject": {
"id": "did:example:angela",
"employer": "AuditsRUs",
"role": "Security Auditor",
"employmentStatus": "active"
},
"credentialStatus": {
"id": "https://auditsrus.example/status/2026#24519",
"type": "StatusList2021Entry",
"statusPurpose": "revocation",
"statusListIndex": "24519",
"statusListCredential": "https://auditsrus.example/status/2026"
},
"proof": {
"type": "DataIntegrityProof",
"cryptosuite": "eddsa-rdfc-2022",
"created": "2026-01-10T15:22:04Z",
"verificationMethod": "did:web:auditsrus.example#key-1",
"proofPurpose": "assertionMethod",
"proofValue": "z3FXQjC7nYq9...abbreviated..."
}
}
The credential example shows an issuer identifier alongside claims, validity dates, revocation status, and an issuer-controlled verification method used to validate the proof. section 16.2
Trust in an issuer is deliberately scoped and maintained:
- Record which credential types the issuer is authorized to provide, rather than treating trust as a blanket approval. section 16.3.2
- Evaluate the governance framework and accreditation that support the issuer’s authority before relying on its credentials. section 16.3
- Check credential expiration and revocation at presentation time; a genuine credential can still describe an outdated relationship. section 16.4
- Update trust decisions when accreditation or governance conditions change, including removing an issuer whose accreditation is revoked. section 16.3.2
Employment claims from an audit firm
AuditsRUs can issue employment and role credentials for its security auditors after being recognized under NISA’s accreditation framework. A verifier may accept AuditsRUs for those credential types while accepting NISA for certification credentials, but not interchange their authority. When an auditor presents a credential, the verifier checks the signature, validity period, revocation status, and issuer’s approved scope before using normalized claims in authorization policy. section 16.3.1 section 16.3.2 section 16.7
Authorization policy should evaluate verified, normalized attributes rather than issuer identifiers or credential formats. The enforcement layer applies issuer trust, signature, freshness, and revocation checks while assembling the request; governance can then add approved issuers or credential types without rewriting policy logic. section 16.9.3 section 16.7
Issuer-related failures need governed handling. A credential can fail because its issuer is no longer trusted, its status is revoked, or a required presentation cannot be produced. Limited, logged exception paths such as temporary permits, break-glass access, or manual review can address exceptional cases without treating failed verification as ordinary access. section 16.9.2 section 16.9
