Standard Credential (Legacy VC 1.0 Era)

The legacy VC 1.0-era wire shape of the KYA-OS DelegationCredential, issued and verified by the session profile

Standard Delegation Credential (Legacy VC 1.0 Era)

The standard delegation credential represents a direct authorization from a delegator to a delegate, expressed as a W3C Verifiable Credential (VC 1.0 data model).

Structure

{
  "@context": [
    "https://www.w3.org/2018/credentials/v1",
    "https://schema.kya-os.org/v1/protocol/delegation/context/v1.0.0"
  ],
  "id": "urn:uuid:3978344f-8596-4c3a-a978-8fcaba3903c5",
  "type": ["VerifiableCredential", "DelegationCredential"],
  "issuer": "did:web:principal.example.com",
  "issuanceDate": "2025-01-01T19:23:24Z",
  "expirationDate": "2025-12-31T23:59:59Z",
  "credentialSubject": {
    "id": "did:key:z6MkDelegate...",
    "delegation": {
      "id": "del-001",
      "issuerDid": "did:web:principal.example.com",
      "subjectDid": "did:key:z6MkDelegate...",
      "constraints": {
        "scopes": ["read:data", "write:calendar"],
        "notBefore": 1735689600,
        "notAfter": 1767225599,
        "audience": "did:web:mcp-server.example.com"
      },
      "status": "active"
    }
  },
  "credentialStatus": {
    "id": "https://example.com/status/123#94",
    "type": "StatusList2021Entry",
    "statusPurpose": "revocation",
    "statusListIndex": "94",
    "statusListCredential": "https://example.com/status/123"
  },
  "proof": {
    "type": "Ed25519Signature2020",
    "created": "2025-01-01T19:23:24Z",
    "verificationMethod": "did:web:principal.example.com#key-1",
    "proofPurpose": "assertionMethod",
    "proofValue": "z43BsK5Fu9Sdw7tF1JwPnBtYu..."
  }
}

Key Properties

  • type: Must include both VerifiableCredential and DelegationCredential
  • credentialSubject: Must carry only id (the delegate's DID) and delegation (the permission payload). A verifier rejects a credential whose subject carries any other property — a DelegationCredential carries a permission, not a claim, and extra subject properties are a confused-deputy vector (SPEC.md §6.2, §11.6)
  • constraints: The CRISP constraint envelope — scopes, temporal bounds, audience, and optional extended CRISP scopes and budgets
  • credentialStatus: A StatusList2021 entry; revocation status is evaluated on every verification
  • delegation.parentId: Present on chained hops, referencing the parent delegation — see Chained Credential