Digital credentials are often discussed from the holder’s perspective: a person stores a diploma, a certificate or a proof of identity in a digital wallet and shares it when needed. For organisations, the more demanding work begins when that credential arrives. Someone needs it for a reason, and that reason sits inside an existing process with its own rules, systems and responsibilities.
A short vocabulary
A few terms help. An issuer is an organisation that makes a statement about someone or something, such as a training institute confirming that a person holds a qualification. A credential is that statement in digital form, secured so that tampering can be detected and the issuer identified. A wallet is the software in which the holder, often the person the credential is about, stores credentials and from which they share them. Verification is the check, by the receiving organisation, that a credential is authentic, unaltered and still current.
The W3C Verifiable Credentials Data Model describes this as an ecosystem of issuers, holders and verifiers. It also draws a distinction that matters for business use. Technical verification does not establish that every claim is true. The organisation then applies its own business rules to determine whether it can rely on the credential for the decision at hand. W3C Verifiable Credentials Data Model 2.0
An illustrative workflow
Take, as an illustration, an organisation that must confirm that a newly assigned employee holds a valid safety qualification before working on a particular site. Today, that often means requesting a scanned certificate, checking it by eye and storing a copy in the HR system. A credential-based workflow could work differently.
First, define the information needed for the decision. The question is not “send us your certificate” but “does this person hold a current qualification of this type, issued by a recognised body?” Being precise about the decision determines what evidence is actually required.
Next, request appropriate evidence. The organisation asks the employee to share a credential that answers that question, and only that. Where the technology allows, the employee may share specific attributes rather than an entire document.
Then check the source, validity and status. The receiving side verifies that the credential is authentic and unaltered, that the issuer is one the organisation accepts for this kind of qualification, that it is within its validity period and that it has not been revoked or suspended.
After that, apply the organisation’s process rules. A valid credential is only one input. Internal rules decide whether this qualification is sufficient for this site, whether additional training is required or whether the case needs manual review.
Return the necessary result to the existing system. The HR or workforce system needs a clear outcome, such as qualified for this role until a given date, or not yet. It usually does not need the full credential.
Finally, retain appropriate evidence. The organisation keeps enough to show what was checked, when and with what result, without copying complete documents into systems that do not need them. That helps when a decision has to be reviewed later, while limiting the personal data held.
Verification is not authorisation
The workflow shows an important distinction. Technical verification answers whether a credential is authentic, unaltered and current, and whether it comes from an issuer the organisation recognises. Business eligibility or authorisation answers a different question: is this person allowed to do this, here, now? That depends on internal policy, context and sometimes human judgement. A verified credential is strong evidence, but it does not automatically justify every decision built on it.
Where WeCross fits
WeCross, a venture in development at Xablu Venture Studio, is building an orchestration and integration layer for this kind of workflow. It is intended to connect the request for evidence, the verification steps and the organisation’s process rules, and to deliver the result to existing systems such as HR, ERP or identity platforms. WeCross is not a new consumer wallet and does not replace those systems. It works between them and the credentials that people and organisations hold. View WeCross
A working integration core has been developed. Commercial validation and the validation of complete end-to-end workflows are continuing, including which wallets, credential formats and enterprise systems the approach should support first.
Starting with one process
Many organisations have processes that are document-heavy for historical reasons: certificates checked by hand, copies stored in several places, the same proof requested again for every new assignment. These are natural candidates for a closer look. Before choosing technology, it helps to answer three questions. Which decision does the process actually support? What is the minimum information needed for that decision? And which system should receive the result?
Is there a document-heavy process in your organisation that could work differently? Choose one, and clarify the decision it supports, the minimum information it needs and the system where the result belongs. We would be glad to explore it with you.
Explore a process →