Delegate SD-JWTs
2026-05-28 , Arena

Discuss an extension to SD-JWTs(RFC9901) to support further delegation from the Holder to a Delegate Holder. This is done by allowing the KB-JWT to also be an SD-JWT, optionally with its own Key Binding.


SD-JWT provides a mechanism for ensuring minimal disclosure in a three party model. This allows an intermediary party (the Holder) to choose to remove claims when only a subset is needed by a verifier. Additionally SD-JWT+KB allows for proof of possession by the Holder using the cnf claim. The Verifier need only trust the Issuer and its policy regarding the cnf key to trust the resulting presentation.

As part of work on the Agentics Payment Protocol we found the need to be able to delegate verifiable credentials from a User (Holder) to the Agent (Delegate Holder) and then have the Agent perform further presentations to a Verifier. SD-JWT+KBs, which began in this forum, provided the capability with a minimal extension. The resulting draft is looking to be brought more generally to standardization for both use in other agentic contexts, as well as more generally for delegation usages.