Trust Chain
In ISBE, any verifiable credential circulating on the network must be traceable back to a known and verifiable point of trust. That point is the trust anchor, and the structure connecting credential issuers to that anchor is called the trust chain.
What this section covers
This section covers the TIR (Trusted Issuers Registry) as an independent infrastructure service: its role model, the lifecycle of accreditations, how to publish and revoke them, and the complete API reference.
If you are looking for the step-by-step procedure to configure the CLI and obtain your first accreditation as part of the network onboarding process, also see the DID → Trust Chain section. Both sections are complementary.
The problem it solves
Any verifier receiving a verifiable credential needs to answer two questions before accepting it:
- Who issued this credential?
- Is that issuer authorized to issue this type of credential in this domain?
Without a structured and verifiable registry, answering the second question would require an out-of-band trust infrastructure (allowlists, centralized PKI, etc.). The TIR solves this by keeping the answers on the ISBE blockchain itself.
What the TIR is
The TIR (Trusted Issuers Registry) is the ISBE on-chain registry that contains the list of entities authorized to issue verifiable credentials, together with the credential types they can issue and the domain in which they operate.
The TIR is implemented as a smart contract (TrustedIssuersRegistryFacet) deployed on the ISBE network. Access is exposed through a JSON-RPC API that allows building and sending transactions to publish or revoke accreditations, and through a REST read endpoint.
Roles in the chain
The trust chain has four defined roles. Three are in production; the fourth is specified but not implemented:
| Role | Full name | Capability |
|---|---|---|
| TA | Trust Anchor | Starting point of the entire chain. ISBE's TA is unique and its DID is configured in verifier clients. |
| RTAO | Root Trusted Accreditation Organisation | Accredits TAOs for a domain. Only ISBE can issue RTAOs. |
| TAO | Trusted Accreditation Organisation | Accredits TIs (or sub-TAOs) within the scope of its accreditation. |
| TI | Trusted Issuer | Issues verifiable credentials of the types authorized in its accreditation. |
| TV | Trusted Verifier | Not implemented. Reserved role for accredited verifiers. |
What an accreditation contains
An accreditation is a verifiable credential (W3C VC Data Model 2.0) that certifies the role of an entity. Each accreditation:
- Is signed by the entity that grants it (the accreditor).
- Specifies the DID of the accredited subject.
- Declares the domain in which it applies (e.g.
"ISBE"). - Lists the credential types the subject can issue or accredit.
- Has an expiry date (
validUntil).
The accreditation JWT is stored publicly and accessible via the TIR URL. This URL is what other ecosystem components (accreditation CLI) use to validate the chain.
Three-step validation flow
When a verifier receives a verifiable credential issued by an entity, it validates the trust chain following these steps:
- Checks the issuer's accreditation (TI): looks up the credential issuer's accreditation in the TIR. Verifies the signature, validity, and that the credential type is within the scope of the accreditation.
- Ascends the chain to the RTAO: using the URL of the TAO that accredited the TI, repeats the process for the TAO. And so on up to the RTAO.
- Verifies that the RTAO is signed by the TA: compares the DID of the RTAO signer with the TA configured in the verifier. If it matches, the chain is valid.
If any link fails (invalid signature, expired accreditation, credential type out of scope, revoked entity), the credential is rejected.
How to continue
- Concepts — detailed model of roles, accreditation types, and lifecycle.
- Environments — TIR URLs and trust anchors per environment.
- Publish an accreditation — step-by-step guide with the CLI.
- Revoke an accreditation — how to revoke and what it implies.
- TIR API Reference — JSON-RPC methods and REST endpoint.