Decentralised identity — verifiable credentials, digital wallets, self-sovereign models that let a person or organization hold and present proof of an attribute without a central identity provider mediating every check — is moving from standards discussion toward real deployment in government and financial services. The pitch is real: less dependence on any single identity provider, and a credential a holder actually controls. What the pitch tends to skip is who inside an adopting organization decides which issuers and which credential schemas are trustworthy enough to accept.The Trust Decision Doesn't Disappear, It MovesA centralised identity provider made an implicit trust decision on an organization's behalf: whatever that provider verified was accepted. A decentralised model removes that single point of mediation, but the underlying question — is this credential, from this issuer, sufficient evidence of what it claims — still has to be answered by somebody. Removing the intermediary does not remove the governance decision; it relocates it inside the accepting organization.What Adopting Decentralised Identity Actually RequiresA named policy for which issuers are trusted: and a process for revisiting that list as issuers, standards and threat models change.A revocation model that is actually tested: a credential that cannot be reliably revoked is a standing risk no matter how strong its cryptographic proof is.A fallback for when verification fails or an issuer is unavailable: a system with no degraded-mode path becomes an availability risk the moment its identity layer has a bad day.Clarity on what the organization is actually trusting: the cryptographic validity of a credential and the trustworthiness of the claim it encodes are two different questions, and a governance programme needs an answer to both.“Decentralising identity does not decentralise the risk decision. It just means the organization accepting a credential can no longer point at someone else's identity provider when that decision turns out to be wrong.”Governance Before the Pilot ScalesNone of this is a reason to avoid decentralised identity models — the direction is sound, and the standards work behind it is maturing quickly. It is a reason to name an owner and a trust policy before a pilot scales into a production dependency, rather than discovering after the fact that nobody inside the organization ever actually decided which issuers deserved to be trusted.Share this articleX (Twitter)LinkedInFacebookCopy Link
Digital IdentityAug 27, 2026The Identity Perimeter That Replaced the Network PerimeterThe network perimeter stopped being the primary control boundary years ago. Most governance programmes have not finished updating their risk model to match.
Digital TrustJun 18, 2026Trust Is Becoming a Measurable Claim, Not a Marketing Line"We take security seriously" used to be an acceptable answer to a customer's due-diligence question. Buyers are increasingly asking for evidence instead.
Regulatory HorizonJul 2, 2026The Regulation That Hasn't Been Written Yet Is Still a Governance QuestionWaiting for a final regulatory text before building the governance capability it will require is a common instinct. It is also usually the most expensive way to comply with it.
