Within this ecosystem, Qualified vLEI Issuers (QVIs) serve as authorized credential issuers who have been qualified by GLEIF to issue specific types of vLEI credentials:

• Legal Entity vLEI Credentials: Attest to the identity of legal entities
• Official Organizational Role (OOR) vLEI Credentials: Attest to official roles within legal entities
• Engagement Context Role (ECR) vLEI Credentials: Attest to functional or contextual roles

The redundant credential problem specifically affects QVIs' credential issuance practices and their adherence to governance framework requirements.

GLEIF Governance Framework

GLEIF maintains comprehensive governance frameworks that define acceptable practices for credential issuance, management, and revocation within the vLEI ecosystem. These frameworks establish:

1. Issuance policies: Requirements for when and how credentials should be issued
2. Lifecycle management: Proper handling of credentials from issuance through revocation
3. Accountability mechanisms: How QVIs are held responsible for their credential management practices
4. Verification procedures: How verifiers should validate credential status

The redundant credential scenario violates these governance principles by creating ambiguity in credential status and undermining the integrity of the revocation mechanism.

Related Governance Entities

Several entities within the vLEI governance structure interact with the redundant credential issue:

• GLEIF: Provides root governance and qualifies QVIs
• QVIs: Authorized issuers who must avoid creating redundant credentials
• Legal Entities: Recipients of vLEI credentials who may be affected by redundant issuance
• Authorized Representatives: Individuals who request and manage credentials on behalf of legal entities
• Verifiers: Entities that validate credential status and may encounter confusion from redundant credentials

The Misbehavior Scenario

Problem Description

The governance concern arises from a specific misbehavior pattern:

1. Duplicate Issuance: A QVI issues two separate instances of the same credential to the same entity
2. Selective Revocation: The QVI subsequently revokes only one of these credential instances
3. Ambiguous State: The external world observes one valid credential remaining in circulation while another has been revoked

This creates a situation where:

• The credential registry shows mixed signals about credential status
• Verifiers may encounter different credential instances with different validity states
• The intent behind the revocation becomes unclear (was it meant to fully revoke the credential or only one instance?)
• The credential holder retains valid credentials despite apparent revocation action

Technical Feasibility vs. Governance Prohibition

Critically, the source documents emphasize that redundant credentials represent a governance issue rather than a technical impossibility. The underlying KERI protocol and ACDC credential format do not inherently prevent a QVI from:

• Issuing multiple credential instances with different SAIDs (Self-Addressing Identifiers)
• Maintaining separate Transaction Event Logs (TELs) for each credential instance
• Selectively revoking individual credential instances through their respective TELs

The phrase "it can be done this way" in the source documents acknowledges this technical capability while simultaneously marking it as not recommended practice. This distinction is important because it means:

1. Prevention requires governance enforcement, not just technical constraints
2. Detection mechanisms must be implemented at the governance layer
3. Accountability frameworks must address this specific misbehavior pattern
4. Auditing processes should monitor for redundant credential issuance

Credential Lifecycle Implications

Normal Credential Lifecycle

Under proper governance, a vLEI credential follows a clear lifecycle:

1. Issuance: QVI creates a single credential instance with a unique SAID
2. Anchoring: The issuance event is anchored to the issuer's KEL (Key Event Log)
3. Registry Recording: The credential's status is recorded in a Transaction Event Log (TEL)
4. Active Period: The credential remains valid and verifiable
5. Revocation (if needed): A single revocation event updates the TEL to mark the credential as revoked
6. Post-Revocation: The credential is no longer valid for verification purposes

Corrupted Lifecycle with Redundant Credentials

When redundant credentials are issued, this lifecycle becomes corrupted:

1. Duplicate Issuance: Multiple credential instances (Credential A and Credential B) exist simultaneously
2. Independent TELs: Each credential has its own TEL tracking its status
3. Selective Revocation: Only Credential A's TEL is updated with a revocation event
4. Ambiguous State: Credential B remains valid while Credential A is revoked
5. Verification Confusion: Different verifiers may encounter different credential instances
6. Intent Uncertainty: The purpose of the revocation becomes unclear

Verification Procedures

For verifiers encountering potential redundant credentials:

1. SAID Verification: Each credential instance has a unique SAID derived from its content
2. TEL Checking: Verifiers must check the specific TEL associated with the credential instance they received
3. Issuer Validation: Verify that the credential was issued by an authorized QVI
4. Status Confirmation: Confirm the current status (issued, revoked, etc.) in the relevant TEL
5. Governance Compliance: Report suspected redundant credential scenarios to governance authorities

The challenge is that verifiers may not know whether other instances of the same credential exist, making it difficult to detect the redundant credential scenario without additional governance-layer monitoring.

Revocation Conditions

Proper revocation under vLEI governance should:

• Affect all instances: If a credential needs to be revoked, all instances should be revoked
• Be unambiguous: The revocation intent should be clear and complete
• Be auditable: Revocation actions should be traceable and explainable
• Maintain integrity: The revocation mechanism should not be undermined by redundant issuance

The redundant credential scenario violates these principles by allowing partial revocation that leaves valid credentials in circulation.

Related Governance Documents

vLEI Ecosystem Governance Framework

The primary governance document addressing credential management practices is the vLEI Ecosystem Governance Framework, which establishes:

• Information security policies for credential handling
• Privacy requirements for credential data
• Availability and integrity standards for credential systems
• Processing integrity policies for credential lifecycle management

This framework applies to all vLEI ecosystem members, including QVIs, and defines the policies that redundant credential issuance violates.

QVI-Specific Governance Documents

Several governance documents specifically address QVI responsibilities:

1. Qualified vLEI Issuer vLEI Credential Governance Framework: Details requirements for QVIs to issue, verify, and revoke credentials properly
2. vLEI Issuer Qualification Agreement: Contractual obligations that QVIs accept when becoming qualified issuers
3. Legal Entity vLEI Credential Governance Framework: Requirements for issuing credentials to legal entities
4. Legal Entity Official Organizational Role vLEI Credential Governance Framework: Requirements for OOR credential issuance
5. Legal Entity Engagement Context Role vLEI Credential Governance Framework: Requirements for ECR credential issuance

Each of these frameworks implicitly prohibits redundant credential issuance by establishing clear, singular credential lifecycle expectations.

Technical Specifications

While redundant credentials are a governance issue, several technical specifications provide the foundation for proper credential management:

• ACDC Specification: Defines the Authentic Chained Data Container format used for vLEI credentials
• KERI Specification: Establishes the Key Event Receipt Infrastructure protocol underlying credential verification
• TEL Specification: Describes Transaction Event Logs used for credential status tracking
• CESR Specification: Defines Composable Event Streaming Representation encoding used throughout the system

These specifications enable the technical infrastructure but rely on governance frameworks to prevent misuse like redundant credential issuance.

Governance Enforcement Mechanisms

Detection Strategies

To prevent and detect redundant credential scenarios, governance frameworks should implement:

1. Issuance Monitoring: Track all credentials issued by each QVI to detect duplicate issuances
2. SAID Correlation: Analyze credential SAIDs to identify suspiciously similar credentials
3. Revocation Pattern Analysis: Monitor revocation events for patterns suggesting selective revocation of redundant credentials
4. Audit Trails: Maintain comprehensive logs of all credential lifecycle events
5. Verifier Reporting: Establish mechanisms for verifiers to report suspected redundant credentials

Accountability Measures

When redundant credential issuance is detected, governance frameworks should provide:

1. Investigation Procedures: Formal processes to investigate suspected violations
2. Corrective Actions: Requirements for QVIs to revoke all instances of redundantly issued credentials
3. Sanctions: Penalties for QVIs that violate credential issuance policies
4. Qualification Review: Potential re-evaluation of QVI qualification status
5. Public Disclosure: Transparency about governance violations to maintain ecosystem trust

Prevention Through Design

While the current system allows redundant credentials technically, future governance and technical enhancements could include:

1. Issuance Constraints: Technical mechanisms to prevent duplicate credential issuance
2. Linked Revocation: Systems that automatically revoke all instances when any instance is revoked
3. Credential Uniqueness Verification: Pre-issuance checks to detect potential duplicates
4. Enhanced Monitoring: Automated systems to detect redundant credential patterns
5. Governance Automation: Smart contract-like enforcement of governance rules

Impact on Trust and Verification

Trust Implications

The redundant credential scenario undermines trust in the vLEI ecosystem by:

• Creating Ambiguity: Verifiers cannot be certain whether a valid credential represents the complete picture
• Weakening Revocation: The revocation mechanism loses credibility if credentials can remain valid despite revocation actions
• Enabling Abuse: Credential holders could potentially exploit redundant credentials to maintain validity after intended revocation
• Reducing Confidence: Ecosystem participants may lose confidence in credential status information

Verification Challenges

Verifiers face specific challenges when redundant credentials exist:

1. Instance Identification: Determining which credential instance they are verifying
2. Status Uncertainty: Uncertainty about whether other instances exist with different status
3. Intent Interpretation: Difficulty understanding the issuer's intent regarding credential validity
4. Risk Assessment: Increased risk in accepting credentials that may have redundant instances

Ecosystem Integrity

Maintaining ecosystem integrity requires:

• Clear Governance: Unambiguous policies prohibiting redundant credential issuance
• Effective Enforcement: Mechanisms to detect and address violations
• Transparent Communication: Clear communication about governance expectations
• Continuous Improvement: Evolution of governance frameworks to address emerging issues

Conclusion

Redundant credentials represent a significant governance challenge in the vLEI ecosystem. While the underlying KERI and ACDC technologies do not technically prevent this scenario, it is explicitly identified as not recommended practice that violates governance principles. The selective revocation of redundant credential instances creates ambiguity, undermines the integrity of the revocation mechanism, and erodes trust in the credential verification process.

Effective governance requires clear policies prohibiting redundant credential issuance, robust detection mechanisms to identify violations, and strong accountability measures to enforce compliance. As the vLEI ecosystem matures, both governance frameworks and technical implementations should evolve to prevent this misbehavior pattern and maintain the integrity of the credential lifecycle.

The distinction between technical capability and governance prohibition is crucial: just because redundant credentials can be issued does not mean they should be issued. Maintaining this governance discipline is essential for the long-term success and trustworthiness of the vLEI ecosystem.

• Technical Constraints: Explore technical mechanisms to prevent duplicate issuance at the protocol level
• Automated Detection: Implement automated systems to detect redundant credential patterns
• Linked Revocation: Consider systems that automatically revoke all instances when any instance is revoked
• Enhanced Accountability: Strengthen accountability measures for QVIs that issue redundant credentials
• Transparency Mechanisms: Provide visibility into credential issuance patterns to enable community oversight