Free Commerce 101 · Lesson 4

Trust that travels

Estimated reading time: 11 minutes

The central idea

An organisation should not lose its earned credentials every time it changes systems.

What you will learn

  • Explain why repeated verification creates needless friction.
  • Distinguish a credential, its issuer, its holder and a verifier.
  • Understand why control over disclosure and revocation are essential.

The same question, again and again

A supplier starts working with a new customer. The customer asks for its legal name, registration details, insurance, relevant qualifications and evidence of compliance. These are often reasonable questions. The difficulty is that the supplier may have answered them repeatedly, in formats that make one customer’s verified work invisible to the next.

Today’s systems frequently store trust privately. A buyer may know a supplier is qualified, but that knowledge cannot safely or easily travel. When the relationship ends, the useful verification work is stranded. When it starts again somewhere else, everyone pays to repeat it.

Free Commerce imagines a different pattern: trust evidence that is portable, verifiable and controlled by the organisation that earned it.

A simple trust model

Suppose an independent body confirms a company’s professional qualification. The body is the issuer. The company is the holder of the resulting credential. A potential customer is the verifier who needs to assess it. The holder can present the credential, and the verifier can check whether it came from the claimed issuer and whether it remains valid.

  1. Issuer
  2. Holder
  3. Verifier
The holder can present the credential, and the verifier can check whether it came from the claimed issuer and whether it remains valid.

This is not the same as saying the credential is always relevant or sufficient. A buyer must decide whether it trusts the issuer, whether the evidence addresses its needs, whether it has expired or been revoked, and whether other checks are necessary. Verification helps establish authenticity; judgement establishes suitability.

Control belongs with participants

A portable credential is not an invitation to publish every private record. The organisation should be able to decide who receives which information, subject to applicable legal obligations. For example, a buyer might need evidence that a supplier holds adequate coverage without receiving unrelated confidential details. Selective disclosure, where supported by appropriate systems, can reduce unnecessary data sharing.

But there are limits. Some regulators and customers legitimately require the underlying evidence. Some credentials change or expire; some are withdrawn. Strong systems need a means to handle revocation, freshness and disputes, and they must protect sensitive information even when the technical exchange is correct.

Reputation is harder than a certificate

A qualification issued by an authoritative body is one kind of evidence. Reputation is another. A platform rating can reflect genuine experience, but it can also depend on opaque algorithms, biased feedback or context that does not transfer fairly. Portability should not turn every star rating into an unquestionable universal judgement.

Better trust infrastructure makes the origin, meaning, evidence and limitations of information understandable. It should distinguish verified facts from opinions and preserve opportunities to challenge mistakes.

The commercial opportunity

Imagine a supplier authorised to share a verified company profile and selected qualifications with a prospective buyer. The buyer’s software can interpret the information consistently, check its provenance and flag what still needs review. A different buyer could repeat the process using compatible tools, without forcing the supplier to reconstruct its identity from the beginning.

The result is not trust without human judgement. It is less repeated administration, clearer evidence and better-informed decisions.

Try it: design a portable credential

Write a one-page description of a supplier insurance credential. Name the issuer, holder and verifier. List what it proves, when it expires, how validity can be checked, what data the buyer actually needs and what should remain undisclosed. Add a plan for correction or revocation. Finally, identify one question the verifier must still decide for itself.

Key terms

  • Credential: Evidence of an asserted fact or qualification, attributable to an issuer.
  • Issuer: Entity making the attestation.
  • Holder: Entity controlling or presenting it.
  • Verifier: Entity assessing it.
  • Provenance: Where information came from and how it was produced.
  • Revocation: A mechanism to indicate evidence should no longer be relied upon.

Remember

Trust should travel with the organisation that earned it – but portability must preserve context, privacy, legitimate rules and accountability. A signature can show that evidence is authentic; it cannot prove that the evidence is adequate for every purpose.

Knowledge check

1. Who decides whether a valid credential meets their needs?
2. Should portable trust require publishing all private information?
3. What is a revocation mechanism for?

Answer key
  1. A. The verifier. Authenticity is not the same as fitness for a specific decision.
  2. B. No. Disclosure should be purpose-limited and legally appropriate.
  3. B. Signalling that prior evidence should no longer be relied on. Trust evidence can expire, change or be withdrawn.

Free Commerce 101 is published by Concert Foundation under a Creative Commons Attribution 4.0 licence. Share and adapt it, with credit and a note of any changes. Code samples are dedicated to the public domain under CC0 1.0. The Concert Foundation and SIGNET names and marks are not licensed.