Glossary
Derived Credential
A derived credential is provisioned onto a new device — typically a phone — from a stronger, original credential such as a hardware smart card, without the original ever having to leave its secure location. The device holding the derived credential can authenticate on its own; the original credential stays exactly where it already was, untouched by whatever risk the new device carries.
This lets a person authenticate from a phone without the phone itself becoming an equally sensitive copy of the original credential — the derived credential can be scoped, time-limited, and revoked independently of the original, which stays put in whatever secure environment it was already issued into and never has to be exposed to the new device's own risk profile.