Build a live verifiable credentials network

The architecture started from open standards, and the standards do their job precisely.

The W3C Verifiable Credentials Data Model defines how a career claim is structured. A credential carries the claims themselves, the identity of the issuer and a cryptographic proof. It also states when it expires and how its status can be checked.

That proof makes the credential tamper-evident. Alter one character and verification fails.

W3C Decentralised Identifiers handle identity. A decentralised identifier resolves to a document holding public keys and service endpoints. That lets an organisation demonstrate control of its identifier, and lets a relying party find the key it needs to check a proof.

Control of an identifier is all it establishes. It says nothing about which real-world organisation stands behind it. Velocity uses did:web and did:ion for organisations.

Disclosure needs its own structure. A relying party has to describe exactly what evidence it wants, and the wallet has to return credentials that satisfy that request. Velocity's exchange protocol uses DIF Presentation Exchange for the matching, with a presentation definition describing the requirement and a presentation submission answering it. Those standards make a credential portable and checkable. They leave one question open, and it is the question an employer actually cares about.

A credential naming Harvard University as its issuer proves that someone controlled the signing key. Whether that someone is Harvard is a separate question. And a university that genuinely is Harvard still has no standing to issue a nursing licence. The Foundation puts the consequence plainly: if a relying party cannot trust that the issuer is who they claim to be, the credential is useless.

Closing that gap is the product. An organisation passes a know-your-business check and registers through the Network Registrar before it can issue anything. The network then issues that organisation an accreditation credential carrying its verified profile, along with permissions describing which credential types it may issue.

Credential types matter more than they sound. A nursing licence carries different compliance rules from a degree certificate, so each type has its own schema. The registry controls who may issue which.

A relying party then runs its checks. It confirms the credential has not been altered and is still valid. It confirms the person presenting it owns it, and that the issuer is accredited for that kind of claim.

The ledger carries what those checks need. It holds the registry of accredited organisations and their permissions, the credential types, and credential status. For each credential, the issuer generates a verification key, encrypts it and writes it to the ledger. A relying party pays to retrieve that key when it verifies.

Issuer DID documents sit outside the ledger and resolve through did:web or did:ion. Credentials and personal data stay in the holder's wallet. Nothing personal is written to the chain.

Cryptography establishes integrity. The trust framework establishes authority.