Heather explores the W3C Digital Credentials API and the challenge of defining shared responsibilities across browsers, operating systems, wallets, and credential protocols. Following discussions at TPAC, the working group has made progress toward an interoperable first version, while important questions about architectural boundaries and privacy remain unresolved. This episode examines selective disclosure, user consent, privacy fatigue, and the risks of relying on other components to protect users. Discover why too many permission prompts can undermine meaningful consent, and what coordinated protections are needed to make digital credentials trustworthy on the Web.