Portable Financial Credentials

The Agent Passport proves behavioral standing: issuer-signed reputation scorecards bundled under chio.agent-passport.v1. This page is the financial counterpart. Passport v2 (schema chio.agent-passport.v2) adds a second credential family, chio.fincred.*: five signed, individually verifiable, selectively disclosable Verifiable Credentials that carry an agent's economic track record (credit standing, exposure, settlement reliability, premium and loss history) across organizations. The behavioral half of this story lives at Portable Reputation; the policy is the same in one line: portable, not transferable. There is no universal or merged financial score, and an imported financial fact stays asserted at the receiving boundary no matter how many signatures verify.

The Credential Path

The home authority signs each credential, the holder carries the bundle, and a receiver recomputes every digest before underwriting reads a single field:

The Five Financial Credentials

Each credential is a signed Verifiable Credential whose type is ["VerifiableCredential", "Chio<Family>Credential"], with an issuer did:chio, an Ed25519 proof, a typed financial subject, and a digest-bound reference to the local signed record it attests over. Monetary values are MonetaryAmount; ratios are integer basis points; only the credit-scorecard risk coefficients stay f64.

Aggregate families do not trust caller-supplied counts. Every family carries an authenticated boundary-complete range proof from the owning source checkpoint for each source set it summarizes, and both issuer and receiver derive the exact range and member count from that proof. A settlement-reliability credential over an empty window returns the unsigned result NoCredential(EmptyWindow) and issues no VC; a signed reliability credential with a zero or missing denominator rejects.

Passport v2 Bundle & Source Manifest

The wire carrier is version-dispatched before any payload is deserialized. A decoder reads the top-level schema first, then invokes the strict decoder for that version; the live v1 APIs reject a v2 schema before field decoding rather than silently dropping fields.

pub enum VersionedAgentPassport {
    V1(AgentPassport),
    V2(AgentPassportV2),
}

pub enum PassportCredentialV2 {
    Reputation(ReputationCredential),
    Financial(FinancialCredentialEnvelope),
}

// AgentPassportV2.credentials: Vec<PassportCredentialV2>

Passport v2 is negotiated explicitly. OID4VCI offers advertise chio.agent-passport.v2 and the financial_credentials_v1 feature, and a holder sends v2 only after that feature is negotiated, so a v1 verifier never silently ignores a financial credential. Conversion is named and lossless in one direction: upgrade_v1_passport wraps each v1 credential as Reputation, and try_downgrade_v2_passport rejects any financial credential rather than dropping data.

Each FinancialCredentialEnvelope carries a stable credential_id, derived as SHA256("chio.fincred.credential-id.v1\0" || RFC8785(id_preimage)). The preimage covers family, issuer, subject DID, issuance and expiration, source window and evidence digests, and the complete typed subject, but excludes the id and the proof. The id is stable across passport packaging and presentation; a renewed or semantically different credential receives a different id.

An issued v2 passport includes a signed PassportSourceManifestV2 with source_passport_id, issuer, subject DID, issued and expiry times, credential_count, and a canonical Merkle root over sorted (credential_id, family, credential_ref_digest) leaves. The credential_ref_digest is SHA-256 over the RFC 8785 canonical complete signed credential envelope, with a domain separator naming the concrete reputation or financial family.

Selective Disclosure & Membership Proofs

Because every credential is individually signed, the holder presents only the credentials a relying party asks for and drops the rest without invalidating the remaining signatures. The presented form is a distinct schema, PresentedAgentPassportV2, which carries the exact signed source manifest, the selected signed credential envelopes, their membership proofs, the challenge digest, and a presentation_digest.

The v2 challenge extends the signed request with allowed and required financial family ids plus optional credential_ref_digest values. Issuer-only filtering is insufficient when one issuer signs all five families, so the challenge selects by family and by exact envelope digest. The presentation_digest is domain-separated RFC 8785 over the source-manifest digest, the challenge digest, and the sorted presented (credential_id, credential_ref_digest) set, so it binds the disclosed subset to one verifier challenge.

Below, a holder answers a settlement-reliability request by disclosing one credential out of five. The verifier recomputes the source id, the manifest root, the leaf membership proof, and the presentation digest before it reads a subject field. The manifest exposes only the root and count; the four omitted credential bodies are never disclosed:

{
  "schema": "chio.agent-passport.v2",
  "presentation": "PresentedAgentPassportV2",
  "source_manifest": {
    "schema": "chio.financial-agent-passport.source-manifest.v1",
    "source_passport_id": "sp_2026_07_10_a3f1c8",
    "issuer": "did:chio:a1b2...",
    "subject": "did:chio:7b0f6f63...",
    "issued_at": "2026-07-10T00:00:00Z",
    "valid_until": "2026-10-08T00:00:00Z",
    "credential_count": 5,
    "merkle_root": "sha256:9c2e4b...",
    "proof": { "type": "Ed25519Signature2020", "proofValue": "..." }
  },
  "challenge_digest": "sha256:41d0a7...",
  "credentials": [
    {
      "family": "chio.fincred.settlement-reliability.v1",
      "credential_id": "sha256:5e7a1c...",
      "credential_ref_digest": "sha256:b83c90...",
      "issuer": "did:chio:a1b2...",
      "credentialSubject": {
        "id": "did:chio:7b0f6f63...",
        "window_start": "2026-04-01T00:00:00Z",
        "window_end": "2026-07-01T00:00:00Z",
        "on_time_count": 1794,
        "obligation_count": 1820,
        "ratio_bps": 9857
      },
      "source_evidence_class": "observed",
      "presentation_evidence_class": "asserted",
      "membership_proof": {
        "leaf": "sha256:e14f...",
        "path": ["sha256:d41a...", "sha256:77b0..."],
        "root": "sha256:9c2e4b..."
      },
      "proof": { "type": "Ed25519Signature2020", "proofValue": "..." }
    }
  ],
  "presentation_digest": "sha256:e0a4d2..."
}

Filtering changes the presentation digest but never the source passport identity, so a valid presentation for one subset cannot be replayed to authorize another subset from the same source passport. The stored ratio_bps = 9857 equals floor(u128(1794) * 10_000 / u128(1820)); the verifier recomputes it and rejects a stored mismatch. Field-level unlinkable disclosure (BBS or zero-knowledge over individual claim fields) is out of scope; v2 selective disclosure is credential-granularity only.

Evidence Classes

Trust is per issuer, not a merged score. Each credential's provenance is graded on the evidence-class ladder asserted < observed < verified through two distinct class fields, source_evidence_class and presentation_evidence_class; an imported fact stays asserted at the receiving boundary:

• source_evidence_class is the floor of the evidence classes of the issuer-local records the credential folds. The issuer computes and verifies this floor against the source records at issuance; a remote verifier cannot recompute it from digest strings alone, so a v2 presentation either includes the bounded signed source bundle or supplies resolvable references its source policy accepts.
• presentation_evidence_class is always asserted once the credential crosses an issuer boundary. Verifying the VC signature authenticates who made the claim; it does not turn imported facts into locally observed or verified evidence.

Per-family caps keep the floor honest. A CreditScorecardCredential cannot exceed asserted when an imported signal influenced the score. A SettlementReliabilityCredential and a LossHistoryCredential cap their issuer-side source class at observed, because settlement and delinquency detection both depend on reconciliation state. A PremiumHistoryCredential may be verified at its home issuer only when every folded decision and its required evidence verifies. A bundle proves membership and source class only; it never proves that omitted records do not exist.

Enterprise Identity Provenance

A passport also records how the agent's identity was verified through an organization's identity provider, carried in EnterpriseIdentityProvenance entries. Each entry names a provider_id, a provider_kind (for example okta or azure-ad), the verified principal, the bound subject_key, optional tenant, organization, groups, and roles, and a federation_method recording how the provider authenticated the principal, as an EnterpriseFederationMethod: Jwt, Introspection, Scim, or Saml. A receiving organization reads this provenance alongside the issuer signature and the credential metrics, without direct access to the issuing organization's identity systems.

Importing into Underwriting as Asserted Evidence

A receiver does not read the credentials directly. It runs evaluate_financial_credentials over a PresentedAgentPassportV2 against an operator-pinned chio.fincred.verifier-policy.v1 (minimum settlement reliability, maximum open exposure against limit, loss thresholds, maximum credential age), evaluated per credential alongside the behavioral PassportVerifierPolicy. The evaluator emits one VerifiedFinancialCredentialSet carrying the sorted credential ids, body and envelope digests, families, issuers, source and presentation classes, the source-manifest digest, and the presentation digest.

Underwriting accepts only that verified type, never caller counts or a merely structurally valid passport. The control plane populates UnderwritingImportedFinancialEvidence on the shared strict chio.underwriting.policy-input.v2 from the verified set, and derive_underwriting_signals emits one Guarded UnderwritingReasonCode::ImportedTrustDependency per accepted imported financial signal, mirroring the reputation branch. Counts may be derived for display but are not underwriting authority. See Underwriting for the decision path these signals enter.

Cross-issuer aggregation stays deliberately unmerged. A chio.cross-issuer-portfolio.v2 lists independently verified passports and a signed chio.cross-issuer-trust-pack.v2 activates them per issuer through locally configured trust anchors, without inventing a synthetic cross-issuer score. A key submitted inside a credential or trust pack is never its own trust root, and every cross-issuer financial input remains asserted at the receiving boundary, including inputs admitted by a trust pack.

See Also

• Agent Passports for the identity carrier, the did:chio schema, and the reputation credential bundle these financial credentials sit beside.
• Portable Reputation for the behavioral counterpart and the portable-not-transferable discipline this page reuses.
• Credit Scorecards for the local signed report an issuer folds into the credit-scorecard credential.
• Underwriting for how a receiver consumes the verified set as imported evidence.