Beltic logo
SDK Guide

Trust Chain Verification

Verify agent credentials with linked developer credentials and policy enforcement.

Trust chain verification ensures an agent credential is linked to a valid, verified developer credential and meets policy requirements.

Basic Trust Chain Verification

import { verifyAgentTrustChain } from '@beltic/sdk';

const result = await verifyAgentTrustChain(agentToken, {
  keyResolver: async (did) => getPublicKey(did),
  fetchDeveloperCredential: async (developerId) => {
    return await fetch(`https://api.beltic.dev/credentials/${developerId}`);
  },
  checkStatus: async (statusEntry) => {
    // Check Status List 2021
    return await checkRevocationStatus(statusEntry);
  },
});

console.log('Agent:', result.agent.credential.agentName);
console.log('Developer:', result.developer.credential.legalName);
console.log('Policy OK:', result.policy.kybOk && result.policy.safetyOk);

Policy Enforcement

const result = await verifyAgentTrustChain(agentToken, {
  keyResolver,
  fetchDeveloperCredential,
  policy: {
    minKybTier: 'tier_2_standard',
    minPromptInjectionScore: 80,
    minPiiLeakageScore: 85,
    minToolAbuseScore: 75,
    minHarmRefusalScore: 90,
    minVerificationLevel: 'beltic_verified',
    prohibitedDataCategories: ['health_phi'],  // Reject PHI processing
  },
});

Status List Helpers

import { 
  StatusListCache,
  decodeStatusList,
  isBitSet,
  parseStatusEntry
} from '@beltic/sdk';

// Create cache with 5-minute TTL
const cache = new StatusListCache(300000);

// Check status
const entry = parseStatusEntry(credential.credentialStatus);
const statusList = await cache.fetch(entry.statusListCredential);
const isRevoked = isBitSet(statusList, entry.statusListIndex);

Next Steps