Skip to content

Clarify validation expectations during linked-credential traversal (closes #758)

Harley Thomas requested to merge public-review/756-vc-traversal-clarification into main

What

Adds a SHOULD-level rule to the VCDM profile conformance list in website/docs/specification/VerifiableCredentials.md:

SHOULD validate each resolved credential using its associated signature, status, and verification material before incorporating that credential into derived conclusions or query results, when traversing a graph of linked credentials

Why

Public review feedback (#758, Anish Karmarkar/Microsoft) asked us to clarify whether validation is expected as part of traversal — verifying each credential/artifact as it is resolved — or whether that's left entirely to consuming systems. Leaving this unstated weakens trust in derived query results across a linked-credential graph (e.g. traceability event chains, DPP/DCC/DTE links).

This adds the recommended pattern without changing the core data model — implementations are still free to build their own traversal logic, but SHOULD validate along the way rather than trusting unverified resolved credentials.

Scope

WIP docs only (website/docs/).

Closes #758

Merge request reports