Verifiable Credentials — VC
The format standardized by the W3C Verifiable Credentials Data Model — a third-party-verifiable representation of attribute claims. A three-party model: an Issuer issues attributes to a Holder (the subject), and a Verifier cryptographically validates them.
Definition
A VC is a set of claims signed by an Issuer, packaged in a portable format. Serializations include JSON-LD, JWT, and CBOR-LD; issuer identity, subject identity, expiration, and revocation method are all built into the format. W3C VC Data Model 2.0 reached Recommendation status in 2025.
The subject is most often identified by a DID. VCs and DIDs are designed as a pair under the W3C "Verifiable Data Model." The EU's eIDAS 2.0 / EUDI Wallet stack adopts the same framework, adding regulatory momentum.
A VC is not just an attribute record; third-party verifiability is guaranteed at the spec level. Signature verification, revocation checking, and expiration validation all execute independently on the verifier side. Combine with selective disclosure or ZK-SD-VC, and a VC can prove "this attribute is satisfied" without revealing the value.
Lemma Oracle implementation
Lemma Compliance issues customer attributes (KYC outcome, region, industry, transaction eligibility) as VCs. The Issuer is a did:web entity under the organization's domain; the Verifier is a counterparty or auditor. Attribute conformance is shown via the VC and its ZK derivatives — without ever shipping certificate files.
In Lemma Civic, residence records and public certificates are issued as VCs, so the "show only the attribute, never the certificate" pattern of municipal DX works out of the box. Verifiers consume the VC through Trust402 for machine verification.
VCs slot directly into the recordkeeping obligation of EU AI Act Article 12 and the audit-trail requirements of ISO/IEC 23894 (AI risk management). Lemma supplies VC + ZK + provenance chains as one package, automating regulatory conformance.