Marc's journey
Five needs, five builds: identity, verifiable services, badges, certification as proof, and Vesta's own ecosystem.
Marc's journey
One checklist, five builds. The picture below opens on the world you met in Section 1 - Vesta, its gray services, the impostors, a customer who can't tell - and each step transforms it. Watch Marc work, and take part with your own wallet.
Vesta Organization identity
First things first: Vesta itself must become provable.
Marc deploys Vesta's Business Wallet
Marc deploys a vs-agent, an open source Business Wallet natively integrated with the public Verana infrastructure. Upon deployment, a decentralized identifier (DID) is generated for Vesta: the identifier everything else attaches to. It proves nothing yet; it is the empty identity card.
did:webvh:QmPLACEHOLDER…:vesta-anchor.demos.testnet.verana.networkPlaceholder until the dedicated Vesta cast is deployed.
Click a participant to see the credentials it presents.
Reproduce it
- 1Deploy a vs-agent on a public domain (Docker image + compose examples in the vs-agent repo).
- 2Open https://<your-host>/.well-known/did.json - that document is your Business Wallet's DID.
- 3Resolve it: https://resolver.testnet.verana.network/v1/trust/resolve?did=<your-did> → UNTRUSTED. That's the starting line.
Under the hood
- The vs-agent generates the DID (did:webvh recommended) and publishes its DID Document with a DIDComm endpoint at https://<host>/.well-known/did.json.
- The Business Wallet will hold and present Vesta's credentials as Linked Verifiable Presentations.
KYB with an accredited issuer
Marc connects to the Verana ECS Ecosystem and chooses an accredited issuer to obtain an Organization credential for Vesta:
- Marc chooses Helvetia Trust Services (demo), an accredited ECS-Org issuer.
- A Know-Your-Business (KYB) process runs between Vesta and Helvetia Trust Services, over DIDComm.
- KYB concludes and Vesta is verified: Vesta's Business Wallet receives its Organization credential.
Click a participant to see the credentials it presents.
Reproduce it
- 1Create a testnet account, get VNA from the faucet, and open the Verana app: https://app.testnet.verana.network.
- 2Discover & Join → ECS Ecosystem → Organization credential schema → Participants.
- 3In the permission tree, pick an active Issuer branch and click Join: you apply as Holder under that issuer, and it becomes your validator. Enter your Business Wallet's DID and submit.
- 4Complete the KYB exchange with the issuer's service over DIDComm; on validation, the ECS-Organization credential lands in your Business Wallet.
Under the hood
- Joining creates a HOLDER permission on the Organization schema via Start Permission VP - the validator is the issuer you joined under.
- After KYB, the issuer confirms with Set Permission VP to Validated; the permission becomes ACTIVE in the public tree.
- The credential is issued over DIDComm and published by the Business Wallet as a Linked VP (#vpr-schemas-org-vtc-vp).
Service identity
Every service in Verana has an accountable controller organization - and an identity of its own.
The Service credential, self-issued
In Verana, any service must have a controller organization (in this case Vesta) and must present an ECS-Service credential for service identification, too. Vesta self-accredits as an issuer of the ECS-Service credential, and its Business Wallet then self-issues the Service credential - valid because the same DID already presents the proven ECS-Organization.
Click a participant to see the credentials it presents.
Reproduce it
- 1In the app: ECS Ecosystem → Service credential schema → Participants → join the tree on the issuer side for your DID.
- 2Issue the ECS-Service credential to yourself via the vs-agent Admin API and link it (the verana-demos scripts wrap this).
Under the hood
- ISSUER permission on ECS-Service per the schema's permission-management mode (tree join, or self-created if OPEN via Create Permission).
- Self-issue through the vs-agent Admin API and publish #vpr-schemas-service-vtc-vp. Self-issuance is valid because the same DID presents ECS-Org - every service traces to an accountable organization.
Vesta employee badges
Badges as verifiable credentials - for both physical access (office, factory) and Vesta's digital services.
Vesta becomes an ECS-Badge issuer
Vesta wants to issue badges as verifiable credentials to its employees, for both physical access (office, factory) and access to Vesta's digital services. To do that, Vesta self-accredits as an issuer of the ECS-Badge credential - and can then issue an ECS-Badge to every employee, received in their Personal Wallet.
- Self-accredit as an issuer of the ECS-Badge credential (a participant entry on the ECS-Badge schema).
- Issue ECS-Badge credentials to employees - each person holds their own, revocable, in their Personal Wallet.
Click a participant to see the credentials it presents.
Reproduce it
- 1See Vesta's participant entry on the ECS-Badge schema in the Verana app: https://app.testnet.verana.network (deep link comes with the Vesta cast).
- 2Open the badge issuer invitation with your wallet and accept the badge after the wallet's issuer check.
Under the hood
- Vesta creates its ISSUER permission on the ECS-Badge schema - visible as a participant in the public tree.
- Issuance runs over AnonCreds/DIDComm for now (Hologram first); the employee's Personal Wallet verifies the issuer is trusted and authorized to issue ECS-Badge (Q2) before accepting.
A verifiable login service, accredited to verify badges
Vesta deploys a new Business Wallet for the login service, and issues it an ECS-Service credential - so the login service is verifiable in its own right (Vesta can do this: it is an accredited ECS-Service issuer). The service is accredited for ECS-Badge verification, and access is configured to only accept badges whose issuer is the DID of the Vesta Organization trust anchor. The same badge can also work at the door:
- Portal login: the verifiable login service requests your badge; only ECS-Badge credentials issued by Vesta's trust anchor DID are accepted. No passwords, no shared logins.
- Physical access: Bluetooth, NFC, or QR-code access to the office or the factory using the ECS-Badge - provided the Personal Wallet used supports it.
Click a participant to see the credentials it presents.
Reproduce it
- 1Deploy a vs-agent for the login service; from the anchor, issue it an ECS-Service credential and link it.
- 2Join the ECS-Badge schema tree as VERIFIER for the login service's DID.
- 3Open the login demo, review the request (who asks, what for), present the badge - you're in.
Under the hood
- Per the Verifiable Trust spec: the login service is verifiable and trusted because its ECS-Service credential was issued by a DID that presents an ECS-Org credential (the Vesta trust anchor) - the service inherits the ECS-Org from the parent service.
- The login service holds the VERIFIER permission on the ECS-Badge schema; its verifier-side policy pins the accepted issuer to the anchor DID.
- The Personal Wallet applies the mirror rule before presenting: verify the verifier is trusted and authorized to request ECS-Badge (Q3).
ISO 9001 credential
Certified since 2003 - now the certificate becomes a verifiable credential on Vesta's identity.
ISO 9001, without re-certifying
Vesta is certified ISO 9001 since 2003. Its certification body, NormaCert (demo), was recently accredited as an issuer of the ISO 9001 credential in the ISO Certification Ecosystem (demo). Good news for Vesta: now that the company holds its Organization credential, it applies to the ISO Certification Ecosystem as a holder of the ISO 9001 credential, selecting NormaCert as its issuer:
- NormaCert's service immediately accepts the request: it identifies Vesta's DID and dereferences its Organization credential.
- Match - the company is in NormaCert's certification database. No paperwork, no identity re-checks.
- NormaCert immediately issues the ISO 9001 credential over DIDComm to Vesta's Organization DID, into its Business Wallet.
Click a participant to see the credentials it presents.
Reproduce it
- 1In https://app.testnet.verana.network: Discover & Join → ISO Certification Ecosystem (demo) → ISO 9001 schema → Participants → Join under NormaCert (demo).
- 2Present ECS-Org over the DIDComm session when asked to identify; receive ISO 9001 on the Organization DID.
Under the hood
- HOLDER permission on the ISO 9001 schema, NormaCert as validator - same tree-join flow, different registry.
- Identification by ECS-Org presentation over DIDComm: reusable organizational identity - the ECS layer is the KYB other ecosystems build on.
Vesta's own rules for its network
Fake support died with the green check. Password phishing died with the badge. Paperwork is dying with reusable KYB. But Umbra Repairs is still out there - and only Vesta can answer “who is an authorized Vesta repairer”. An organization that consumed trust can also produce it.
The Vesta Repair Network
Vesta publishes a one-page governance framework and creates its ecosystem with a single credential schema: Authorized Repairer. The design choice that matters: issuance is governed - only Vesta and its subsidiaries issue - and verification is open: anyone checks, no permission needed. Vesta accredits two subsidiary issuers, Vesta Iberia and Vesta Nordics. Then Zenith Repairs joins, itself a verifiable organization (it walked the same journey: anchor, KYB, ECS-Service - the pattern replicates; that is the point): Vesta Iberia identifies Zenith by the ECS-Org credential on its DID and issues Authorized Repairer to Zenith's organization DID.
Click a participant to see the credentials it presents.
Reproduce it
- 1In https://app.testnet.verana.network: My Ecosystems → create a trust registry (name + governance-framework document).
- 2Add the “Authorized Repairer” credential schema: issuance mode ECOSYSTEM, verification mode OPEN. Create the root permission.
- 3From Zenith's account: open the new ecosystem → Authorized Repairer schema → Participants → Join under Vesta's root.
- 4From Vesta's side: the application appears in Pending Tasks - verify Zenith's ECS-Org presentation, validate, issue.
Under the hood
- Create New Trust Registry (+ EGF document) → Create New Credential Schema (issuer mode ECOSYSTEM, verifier mode OPEN) → Create Root Permission. Three transactions, and Vesta is an ecosystem.
- Governed issuance does not mean a single issuer: Vesta can register several entities (for example its subsidiaries) as issuers of the Authorized Repairer schema by granting them ISSUER permissions under its root.
- Zenith joins the tree as HOLDER under Vesta's root; Vesta validates by verifying Zenith's ECS-Org presentation - reusable KYB, now from the issuer's seat.
- Extension: Zenith can in turn issue technician badges to its employees, so the technician at your door can prove they're from an authorized repairer.
Authorized Repairer login - and at the front door
The Authorized Repairer credential now works everywhere trust is needed:
- Zenith Repairs issues ECS-Badges to its employees - each technician holds one in their Personal Wallet.
- Zenith employees can now log in to the Vesta portal: when they present their ECS-Badge, Vesta knows the badge was issued by Zenith Repairs - and allows access, because Zenith Repairs presents an Authorized Repairer credential.
- At the door, the worker presents their badge to the customer; the customer scans it and sees the Vesta Authorized Repairer seal.
Click a participant to see the credentials it presents.
Reproduce it
- 1Get a badge from Zenith Repairs and try the Vesta portal login (see Run the demos below).
- 2Scan a technician's badge with your wallet: the issuer chain ends at the Vesta Repair Network seal.
Under the hood
- Zenith self-accredits as an ECS-Badge issuer (the same move Vesta made in 3.3) and issues badges to its employees.
- The Vesta login service's verifier policy accepts ECS-Badge from Vesta's anchor DID (employees) or from any issuer DID presenting a valid Authorized Repairer credential (partner employees). Two rules cover the whole network.
- The customer's wallet resolves the badge issuer's DID: Zenith's chain shows ECS-Org, ECS-Service, and Authorized Repairer under the Vesta Repair Network - the seal.
Every box on Marc's list, checked: proven identity · verifiable services · badge login · portable certification · Vesta's own governed trust ecosystem. What Vesta consumed, Vesta now provides.