A verifiable credential presentation is a holder-generated, signed object that supplies the claims a verifier needs for an authorization decision. Rather than sending a credential unchanged, the holder’s wallet creates a presentation for the request; the verifier can validate it independently and use the verified claims as trusted context. section 16.2.1 section 16.5
A claim-based presentation flow separates disclosure, trust validation, and authorization:
- A Policy Enforcement Point (PEP) requests the attributes required by the applicable policy, not a particular credential. section 16.5
- The holder’s wallet selects needed claims from one or more credentials and assembles a signed presentation containing only that information. section 16.5
- The PEP verifies signatures, issuer trust, holder binding, freshness, and revocation before extracting claims. section 16.2.2
- A mapping layer normalizes verified claims into an internal attribute schema, and the Policy Decision Point (PDP) evaluates those attributes with other request context. section 16.6
Figure 16.3 Claim-based credential presentation. Upon receiving an access request, the PEP requests the specific attributes it needs for the authorization decision. The holder’s wallet receives the attribute query, selects the necessary claims from one or more credentials, and assembles a signed presentation. The PEP verifies the presentation and prepares the claims for policy evaluation.
The flow shows how an attribute query becomes a wallet-assembled presentation, then verified claims prepared for policy evaluation. section 16.5
External auditor access
Angela’s wallet combines an employment credential from AuditsRUs with a CISA-R certification from NISA. After verification, policies evaluate her employer, certification, trusted issuers, and engagement time window. If those conditions hold, she receives limited log-viewing access without an ACME account or persistent access after the audit. section 16.2.2 section 16.6
Presentations let external attributes cross organizational boundaries without directory synchronization, federation, or prior bilateral relationships. Different presentation protocols may carry them, but authorization can retain the same pattern: verify claims at the PEP, normalize them, and evaluate policy at the PDP. section 16.2.1 section 16.7
