The main risks are weak issuer trust, poor revocation handling, inconsistent assurance levels, and unclear consent records. If those controls are not explicit, selective disclosure can create uncertainty about what the relying party is allowed to trust, which turns portability into fragmented decision-making instead of stronger governance.
How wallet-based identity flows become a governance problem
Wallet-based identity changes governance because the relying party no longer receives a simple, centralised assertion trail. It receives selectively disclosed claims, often across multiple issuers and formats, so trust depends on who issued the credential, how that issuer is governed, and whether the wallet flow preserves enough evidence for the relying party to make a defensible decision.
The practical issue is that portability can hide fragmentation. A wallet may simplify the user experience, but governance still needs a clear answer to three questions: which issuers are trusted, which assurance levels are acceptable, and what evidence is retained when a claim is presented. The Digital Identity, eID and Identity Wallets Guide is useful here because it frames wallets as trust frameworks, not just user interfaces.
That distinction matters when wallets are used across multiple ecosystems. If a relying party accepts a wallet presentation without aligning issuer policy, revocation status, and claim provenance, it may be making a business decision on incomplete governance signals rather than on controlled identity evidence.
Which control gaps create the biggest decision risk?
The biggest governance gaps are usually not cryptographic failure, but control ambiguity. Weak issuer trust means the relying party cannot tell whether the credential source meets its own policy. Poor revocation handling means a once-valid claim can remain useful after it should have been withdrawn. Inconsistent assurance levels create uneven trust across similar transactions, which makes policy enforcement hard to justify and harder to audit.
Selective disclosure adds another layer of complexity. It is valuable for privacy, but only when the relying party knows exactly what was concealed, what was revealed, and what that means for the decision being made. The eIDAS 2.0, EU Digital Identity Framework is a strong external reference point because it formalises wallet-based identity within a trust structure rather than treating the wallet as an isolated app feature.
Consent records are the fourth governance pressure point. If consent is not explicit and traceable, organisations may not be able to prove that a relying party was allowed to receive or rely on a specific attribute set. That turns a reusable identity flow into a series of local exceptions, which weakens governance consistency and complicates dispute handling.
What should practitioners validate before they trust the flow?
Wallet-based identity flows are strongest when governance checks are built into the decision path, not added after a transaction fails. Practitioners should verify issuer allowlists, accepted assurance levels, revocation freshness, presentation provenance, and consent capture before treating a wallet assertion as sufficient for access or onboarding.
They should also distinguish between user convenience and control certainty. A wallet can reduce friction while still leaving the relying party responsible for assurance alignment, attribute minimisation, and evidence retention. The NIST SP 800-63 Digital Identity Guidelines help anchor that judgement because assurance is not just about authentication strength, it is about how much confidence the organisation needs for the transaction at hand.
Where wallets are part of a broader federated or delegated flow, the relying party should validate how tokens, presentations, and consent artefacts map to its own governance policy. The OpenID Connect Core 1.0 specification is relevant when wallet-driven sign-in or presentation is being integrated with existing identity systems and the organisation needs a clear bridge between authentication and downstream trust decisions.
Risk and Threat Considerations
Wallet-based identity creates a governance risk when the organisation assumes portability has replaced policy. In practice, the main failure mode is trust drift: issuers, wallets, and relying parties can each apply different assumptions, and the final decision may rest on an attribute set whose origin, freshness, or authority is not fully visible.
Failure mechanism: Inconsistent issuer governance, stale revocation status, or weak consent evidence lets a relying party accept a presentation that looks valid but is not policy-complete for the transaction.
Impact: The organisation may approve access, onboarding, or high-value transactions on the basis of a claim it cannot confidently defend later, which increases audit exposure and weakens dispute resolution.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-63 and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | Digital Identity Guidelines | Wallet assurance, revocation and identity confidence are central to this flow. |
| Recommendation — Align wallet acceptance to the required assurance level for each transaction. | ||
| NIST SP 800-53 Rev 5 | IA-8 — Identification and Authentication (Non-Organizational Users) | Wallet flows rely on external user identity assurance and presentation trust. |
| AU-10 — Non-repudiation | Consent records and claim provenance need traceable evidence for disputed wallet decisions. | |
| Recommendation — Require strong external-user authentication and proofing before relying on wallet claims. Retain verifiable evidence for accepted wallet attributes and consent decisions. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | Wallet-based trust decisions must be governed by explicit access rules and acceptance criteria. |
| A.5.16 — Identity management | Issuer trust, attribute ownership and lifecycle governance are core to wallet identity flows. | |
| Recommendation — Define wallet claim acceptance rules as part of access control policy. Assign ownership and lifecycle rules for issuers, claims and wallet-held credentials. | ||
Practitioner Guidance
What to prioritise: Treat issuer approval, revocation checks, assurance mapping, and consent logging as one governance chain. If any link is missing, do not treat the wallet presentation as decision-grade evidence.
What to verify: Confirm that the relying party can reconstruct why a specific attribute set was accepted, including issuer policy, attribute scope, and the revocation state at the time of use.
Common mistake: Teams often optimise for user portability first and then try to retrofit governance after adoption. That usually produces fragmented trust rules, inconsistent approvals, and weak auditability.
Practitioner takeaway: Wallet-based identity is governed by the quality of the trust chain, not by the elegance of the wallet experience, so the control objective is to make every accepted presentation explainable, current, and policy-bound.
Related resources from NHI Mgmt Group
- Why is it important to integrate identity and data governance?
- What is the difference between role-based access and API key governance for NHI security?
- What breaks when verifier identity is not governed in wallet-based flows?
- Should organisations pilot wallet-based identity before formal governance is in place?