Credential Lifecycle: Who Owns Issuance, Revocation, and Renewal

The article outlines a verifiable credential credential lifecycle across identity proofing, issuance, active use, revocation, and expiry. It stresses that long-term success depends on clear ownership of each step to protect residents and maintain public trust. Key responsibilities by credential lifecycle stage: (1) Enrollment and identity proofing are owned by the issuer or a proofing service acting for them. (2) Issuance is owned by the issuer, who signs the credential, manages signing keys, enforces schema/format rules, and ensures data accuracy and expiry dates. (3) Active use shifts trust checks to verifiers, while holders use wallets to store credentials and follow presentation constraints. (4) Revocation/status management remains the issuer’s responsibility, and revocation design must balance fast invalidation with privacy risk. (5) Expiry and renewal require issuer-led communication and renewal workflows to avoid unnecessary full re-enrollment. The article highlights that failures usually occur at handoffs between stages—e.g., identity proofing data not passing correctly to issuance, revocation systems lacking a maintainer, or renewals that create friction. For multi-agency programs, documenting lifecycle responsibilities helps residents understand rejection reasons and helps operators stay accountable.