Gating with checkCredential

KeyringCore exposes credential checks as view functions. A gate is one require on a hot path; no token transfers, no callbacks, no state changes.

The signature

function checkCredential(uint256 policyId, address entity) external view returns (bool);

A check returns true only when the entity has an unexpired credential for the policy and is not blacklisted for it. There is no partial answer: expired, missing, and blacklisted all return false.

Gating a function

import {IKeyringCore} from "keyring-smart-contracts/src/interfaces/IKeyringCore.sol";
 
contract GatedVault {
    IKeyringCore public immutable keyring;
    uint256 public immutable policyId;
 
    error NotCompliant(address entity);
 
    constructor(IKeyringCore keyring_, uint256 policyId_) {
        keyring = keyring_;
        policyId = policyId_;
    }
 
    modifier onlyCompliant() {
        if (!keyring.checkCredential(policyId, msg.sender)) {
            revert NotCompliant(msg.sender);
        }
        _;
    }
 
    function deposit() external onlyCompliant {
        // gated logic
    }
}

Gating a transfer between two parties

The dual-entity overload suits transfer hooks, where sender and receiver must both be compliant:

function _beforeTransfer(address from, address to) internal view {
    require(keyring.checkCredential(policyId, from, to), "transfer party not compliant");
}

Reading credential detail

When a boolean is not enough, the underlying data is public:

function entityExp(uint256 policyId, address entity) external view returns (uint256);
function entityBlacklisted(uint256 policyId, address entity) external view returns (bool);
function entityData(uint256 policyId, address entity) external view returns (EntityData memory);

entityExp returns the credential’s expiration timestamp, useful for showing a renewal prompt before access actually lapses.

Practical notes

• Credentials are chain-specific; a credential issued on Base says nothing on Arbitrum. Check on the chain where the gate runs, against that chain’s deployment.
• The check is a view call, so frontends can pre-check before sending a transaction and route non-compliant users into the verification flow instead of letting the transaction revert.
• Credential issuance, expiry, and revocation are covered in credential lifecycle.