Attribute-based access control using verifiable credentials

Verifiable credentials provide cryptographically verifiable claims about subjects and can therefore serve as a source of trusted attributes for authorization. Although prior work has demonstrated the use of self-sovereign identity and credential-derived attributes for attribute-based authorization, their systematic integration into service-oriented authorization architectures remains an engineering challenge. This work focuses on externalized authorization in application architectures and examines how decentralized identity can be leveraged beyond authentication to support attribute-based access control. We investigate how authorization based on verifiable credential claims can be systematically integrated into a structured engineering approach, including the specification of fine-grained access policies that combine credential-derived attributes with protected resource metadata, as well as the opportunities and limitations introduced by decentralized identity. To address these challenges, we propose an engineering approach that guides developers in applying fine-grained authorization using verifiable credentials. The resulting architecture cleanly separates authentication from authorization, enabling attribute-driven policy evaluation. ... mehrUsing AuthZEN, access rules are expressed as comparisons between verified credential claims and contextual or resource-specific metadata. We demonstrate the approach through a concrete example of document-level access control and clarify the practical applicability and limitations of decentralized identity for authorization