The door doesn’t have to issue the credential

Let me start with an example I use a lot. Two thousand years ago a guard stood at a gate with no technology. He had instructions from whoever owned the place: Jonathan has access. When Jonathan showed up, the guard recognized him with his own eyes and let him in. That’s access control. Identify the person, check what they’re allowed to do, decide.

The moment we put a machine on the door, that broke. A reader can’t recognize Jonathan. So we gave him a token the reader could recognize and attached his permissions to it. That’s the birth of the credential. Every generation since, cards, fobs, Bluetooth, NFC, changed the user experience. None of it changed the architecture. We issue a thing, then we verify the thing we issued.

Here’s what’s different now. For the first time, Jonathan can exist digitally in a form the door can trust. A mobile driver’s license, a digital passport, a national ID: a government has already proofed him, bound that identity to keys, signed it, and put it in the wallet on his phone. When he taps, he proves with cryptographic certainty that an issuer we trust says he’s Jonathan. Which puts us right back at the gate. Recognize the person, check what they’re allowed to do, decide. We didn’t issue anything.

Think about what falls away when you don’t issue. Enrollment. Provisioning. The help desk for whatever got lost. Lifecycle management as people join, change roles, and leave. The whole orchestration dance of texting someone a link so they can sign into something and hunt for the add-to-wallet button. All of that exists because we had to manufacture the token. If the token already exists and somebody else maintains it, I’m out of the issuance business. That’s it.

The paper states this precisely, and the precision matters because the loose version is wrong. Issuing a credential creates a standing obligation that lasts as long as the credential does and grows with every one you issue. Verifying one creates no obligation at all. A verification happens, produces a decision and an audit record, and leaves nothing behind to tend. The issuing side of this industry carries a portfolio it maintains forever. The verifying side carries nothing between transactions. That isn’t a smaller cost. It’s a different shape of cost.

Now the part people get wrong. This doesn’t eliminate issuance. It moves the expensive part. Identity proofing, device provisioning, recovery, the work that actually costs money, moves to the government that already does it as public infrastructure. Your bank consumes the plastic license in your wallet every day and never paid a dime for it. What’s left for an organization to issue isn’t an identity. It’s an authorization: this person works here, holds this role, can get into this area until this date. No government encodes that, because it isn’t an identity fact. It’s a relationship between you and the person, and only you can attest to it. An authorization is a far lighter thing than a credential. No proofing, no provisioning, no recovery, usually short-lived.

I’ll also say plainly what this isn’t. It isn’t a replacement. Physical and mobile credentials remain the right answer for plenty of environments, and a single-modality product has never made commercial sense in this industry. This is a third modality, the one we never had shared infrastructure to consume. The paper’s claim is narrower than replacement and more durable for it: the architecture is cleaner, its cost scales with access events instead of credentials outstanding, and as government identity reaches more people, new deployment drifts toward it.

Three things I’ve seen recently tell me where this is going. A member of our working group walked up to a standalone lock, presented the license his state issued him from the wallet on his phone, and opened the door. Nobody enrolled him. One major wallet’s latest release offers, after a first presentation, to remember the disclosure so it stops prompting on every tap; consent at access tempo is a problem the paper lists as still in development, and the platforms are working it from their end. And in a meeting not long ago, a CEO opened the wallet on his phone and found his state license already in it. He hadn’t known. A lot of people are carrying the credential and don’t know it yet.

What makes this deployable instead of merely possible is the layer between the credential and the door: knowing which issuers and verifiers count, a shared format for what the verifier attests, a registry that resolves trust across credential types, governance for extending and revoking it, and the operational properties a regulated site needs. That layer is what the NFID Foundation exists to specify, and it’s what the next six pieces in this series are about.

The way we tap to pay everywhere we go, we’ll tap to ID everywhere we go. The door is one of the places it happens.