Worked example · KYA flow

Agent checkout: booking a train ticket on someone's behalf

A principal issues a scoped delegation, the agent presents a verifiable credential, the service verifies identity and authorisation at the point of action, the action is written to an audit trail, and revoking the delegation stops the next action. Everything below runs locally in your browser.

The canonical flow

  1. Principal issues a scoped delegation
    Alicia grants railbot-7 permission to buy one HEL→TRE ticket, ≤ €60, before the mandate expires.     pending
  2. Agent presents a verifiable credential
    A short-lived delegated token: actor = agent, subject = principal, bound to the agent's key.     pending
  3. Service verifies identity and authorisation
    Signature, issuer, audience, expiry, proof-of-possession, then this action against the scope.     pending
  4. Action logged to the audit trail
    Actor, principal, mandate, action, decision, amount, outcome — with a correlation ID.     pending
  5. Revocation stops the next action
    Withdraw the delegation; the very next booking is refused.     pending

Identity & authority

Principal
—
Agent identity
—
Mandate
—
Scope
—
Credential
—
Revoked
no

Verification checks

  • Signature valid
  • Issuer trusted
  • Audience matches this service
  • Not expired
  • Proof-of-possession matches key
  • Action within delegated scope
  • Not revoked

Audit trail (append-only, most recent first)