diff --git a/Cargo.lock b/Cargo.lock
index d8eff9b5..e22b3fe1 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -316,8 +316,10 @@ version = "0.1.0"
 dependencies = [
  "agent_holder",
  "agent_issuance",
+ "agent_library",
  "agent_secret_manager",
  "agent_shared",
+ "agent_store",
  "anyhow",
  "async-std",
  "async-trait",
@@ -343,6 +345,7 @@ dependencies = [
  "strum 0.26.3",
  "strum_macros 0.26.4",
  "thiserror 1.0.69",
+ "tokio",
  "tracing",
  "tracing-test",
  "types-ob-v3",
@@ -359,6 +362,7 @@ dependencies = [
  "async-trait",
  "chrono",
  "cqrs-es",
+ "oid4vci",
  "rstest",
  "serde",
  "serde_json",
diff --git a/agent_api_rest/openapi.yaml b/agent_api_rest/openapi.yaml
index da7fc56c..5fed5dc1 100644
--- a/agent_api_rest/openapi.yaml
+++ b/agent_api_rest/openapi.yaml
@@ -366,99 +366,6 @@ paths:
           description: Authorization Request not found
 
   # Issuance endpoints
-  /v0/credential-configurations:
-    post:
-      tags:
-        - Issuance
-      summary: Create a new Credential Configuration
-      description: Creates a new credential configuration for the issuer
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              type: object
-              properties:
-                credential_configuration_id:
-                  type: string
-                  example: w3c_vc_credential
-                format:
-                  type: string
-                  example: jwt_vc_json
-                credential_definition:
-                  type: object
-                  properties:
-                    type:
-                      type: array
-                      items:
-                        type: string
-                        example: VerifiableCredential
-                      example:
-                        - VerifiableCredential
-                display:
-                  type: array
-                  items:
-                    type: object
-                    properties:
-                      locale:
-                        type: string
-                        example: en
-                      logo:
-                        type: object
-                        properties:
-                          alt_text:
-                            type: string
-                            example: UniCore Logo
-                          uri:
-                            type: string
-                            example: https://impierce.com/images/logo-blue.png
-                      name:
-                        type: string
-                        example: Identity Credential
-                  example:
-                    - locale: en
-                      logo:
-                        alt_text: UniCore Logo
-                        uri: https://impierce.com/images/logo-blue.png
-                      name: Identity Credential
-              required:
-                - credential_configuration_id
-                - format
-                - credential_definition
-            examples:
-              openbadgesv3_credential_configurations:
-                summary: Open Badges 3.0
-                value:
-                  credential_configuration_id: openbadge_credential
-                  credential_definition:
-                    type:
-                      - VerifiableCredential
-                      - OpenBadgeCredential
-                  display:
-                    - locale: en
-                      logo:
-                        alt_text: UniCore Logo
-                        uri: https://impierce.com/images/logo-blue.png
-                      name: Identity Credential
-                  format: jwt_vc_json
-              w3c_vc_credential_configurations:
-                summary: W3C VC Data Model
-                value:
-                  credential_configuration_id: w3c_vc_credential
-                  credential_definition:
-                    type:
-                      - VerifiableCredential
-                  display:
-                    - locale: en
-                      logo:
-                        alt_text: UniCore Logo
-                        uri: https://impierce.com/images/logo-blue.png
-                      name: Identity Credential
-                  format: jwt_vc_json
-      responses:
-        "200":
-          description: A Credential Configuration has been successfully added to the Credential Issuer Metadata
-
   /v0/offers/send:
     post:
       summary: Send an offer
diff --git a/agent_api_rest/postman/ssi-agent.postman_collection.json b/agent_api_rest/postman/ssi-agent.postman_collection.json
index 077b35b2..3c8edc9b 100644
--- a/agent_api_rest/postman/ssi-agent.postman_collection.json
+++ b/agent_api_rest/postman/ssi-agent.postman_collection.json
@@ -430,33 +430,6 @@
 						}
 					},
 					"response": []
-				},
-				{
-					"name": "Create a new Credential Configuration",
-					"request": {
-						"method": "POST",
-						"header": [],
-						"body": {
-							"mode": "raw",
-							"raw": "{\n    \"credential_configuration_id\": \"002\",\n    \"format\": \"jwt_vc_json\",\n    \"credential_definition\": {\n        \"type\": [\"VerifiableCredential\"]\n    },\n    \"display\": [\n        {\n        \"name\": \"Verifiable Credential\",\n        \"locale\": \"en\",\n        \"logo\": {\n            \"uri\": \"https://www.impierce.com/external/impierce-logo.png\",\n            \"alt_text\": \"Impierce Logo\"\n        }\n        }\n    ]\n}",
-							"options": {
-								"raw": {
-									"language": "json"
-								}
-							}
-						},
-						"url": {
-							"raw": "{{HOST}}/v0/credential-configurations",
-							"host": [
-								"{{HOST}}"
-							],
-							"path": [
-								"v0",
-								"credential-configurations"
-							]
-						}
-					},
-					"response": []
 				}
 			]
 		},
diff --git a/agent_api_rest/src/authorization/authorization_server/authorize.rs b/agent_api_rest/src/authorization/authorization_server/authorize.rs
index 9eeb91d4..2583ed88 100644
--- a/agent_api_rest/src/authorization/authorization_server/authorize.rs
+++ b/agent_api_rest/src/authorization/authorization_server/authorize.rs
@@ -12,10 +12,11 @@ use axum::{
 };
 use http::header;
 use oid4vci::wallet::AuthorizationRequestByReference;
+use std::sync::Arc;
 
 #[axum_macros::debug_handler]
 pub(crate) async fn authorize(
-    State(state): State<AuthorizationState>,
+    State(state): State<Arc<AuthorizationState>>,
     Query(authorization_request): Query<AuthorizationRequestByReference>,
 ) -> Result<Response, PublicError> {
     match OAuth2AuthorizationService::handle_authorization_request(&state, authorization_request)
@@ -109,7 +110,7 @@ pub mod tests {
     #[serial_test::serial]
     #[tokio::test]
     async fn test_authorization_endpoint() {
-        let issuance_state = issuance_state(&InMemory, Service::default(), Default::default()).await;
+        let issuance_state = Arc::new(issuance_state(&InMemory, Service::default(), Default::default()).await);
 
         agent_issuance::state::initialize(&issuance_state).await.unwrap();
 
@@ -120,7 +121,8 @@ pub mod tests {
         let AuthorizationCode { issuer_state, .. } = authorization_code.unwrap();
         let issuer_state = issuer_state.unwrap();
 
-        let authorization_state = authorization_state(&InMemory, Service::default(), Default::default()).await;
+        let authorization_state =
+            Arc::new(authorization_state(&InMemory, Service::default(), Default::default()).await);
         agent_authorization::state::initialize(&authorization_state)
             .await
             .unwrap();
diff --git a/agent_api_rest/src/authorization/authorization_server/consent.rs b/agent_api_rest/src/authorization/authorization_server/consent.rs
index c0fcca18..5591a809 100644
--- a/agent_api_rest/src/authorization/authorization_server/consent.rs
+++ b/agent_api_rest/src/authorization/authorization_server/consent.rs
@@ -12,11 +12,12 @@ use axum::{
 };
 use http::{header, StatusCode};
 use serde::{Deserialize, Serialize};
+use std::sync::Arc;
 use tracing::info;
 
 #[axum_macros::debug_handler]
 pub(crate) async fn get_consent(
-    State(state): State<AuthorizationState>,
+    State(state): State<Arc<AuthorizationState>>,
     StringifiedQuery(GetConsentQuery { request_uri }): StringifiedQuery<GetConsentQuery>,
 ) -> Result<Response, PublicError> {
     let ConsentPageViewModel {
@@ -47,7 +48,7 @@ pub struct ConsentForm {
 
 // TODO: investigate replay attacks as described here: https://github.com/impierce/ssi-agent/issues/241
 pub async fn post_consent(
-    State(state): State<AuthorizationState>,
+    State(state): State<Arc<AuthorizationState>>,
     Form(ConsentForm {
         client_id,
         request_uri,
diff --git a/agent_api_rest/src/authorization/authorization_server/par.rs b/agent_api_rest/src/authorization/authorization_server/par.rs
index bf843e4e..8d631d72 100644
--- a/agent_api_rest/src/authorization/authorization_server/par.rs
+++ b/agent_api_rest/src/authorization/authorization_server/par.rs
@@ -7,10 +7,11 @@ use axum::{
     response::{IntoResponse, Response},
 };
 use oid4vci::authorization_request::AuthorizationRequest;
+use std::sync::Arc;
 
 #[axum_macros::debug_handler]
 pub(crate) async fn par(
-    State(state): State<AuthorizationState>,
+    State(state): State<Arc<AuthorizationState>>,
     StringifiedForm(pushed_authorization_request): StringifiedForm<AuthorizationRequest>,
 ) -> Result<Response, PublicError> {
     let pushed_authorization_response =
@@ -103,7 +104,7 @@ pub mod tests {
     #[serial_test::serial]
     #[tokio::test]
     async fn test_pushed_authorization_request_endpoint() {
-        let issuance_state = issuance_state(&InMemory, Service::default(), Default::default()).await;
+        let issuance_state = Arc::new(issuance_state(&InMemory, Service::default(), Default::default()).await);
 
         agent_issuance::state::initialize(&issuance_state).await.unwrap();
 
@@ -114,7 +115,8 @@ pub mod tests {
         let AuthorizationCode { issuer_state, .. } = authorization_code.unwrap();
         let issuer_state = issuer_state.unwrap();
 
-        let authorization_state = authorization_state(&InMemory, Service::default(), Default::default()).await;
+        let authorization_state =
+            Arc::new(authorization_state(&InMemory, Service::default(), Default::default()).await);
         agent_authorization::state::initialize(&authorization_state)
             .await
             .unwrap();
diff --git a/agent_api_rest/src/authorization/authorization_server/token.rs b/agent_api_rest/src/authorization/authorization_server/token.rs
index 1fb9af68..bc8298ef 100644
--- a/agent_api_rest/src/authorization/authorization_server/token.rs
+++ b/agent_api_rest/src/authorization/authorization_server/token.rs
@@ -9,10 +9,11 @@ use axum::{
     Form,
 };
 use oid4vci::token_request::TokenRequest;
+use std::sync::Arc;
 
 #[axum_macros::debug_handler]
 pub(crate) async fn token(
-    State((authorization_state, issuance_state)): State<(AuthorizationState, IssuanceState)>,
+    State((authorization_state, issuance_state)): State<(Arc<AuthorizationState>, Arc<IssuanceState>)>,
     Form(token_request): Form<TokenRequest>,
 ) -> Result<Response, PublicError> {
     let token_response =
@@ -138,7 +139,7 @@ pub mod tests {
     #[serial_test::serial]
     #[tokio::test]
     async fn test_token_endpoint(#[case] is_pre_authorized: bool) {
-        let issuance_state = issuance_state(&InMemory, Service::default(), Default::default()).await;
+        let issuance_state = Arc::new(issuance_state(&InMemory, Service::default(), Default::default()).await);
 
         agent_issuance::state::initialize(&issuance_state).await.unwrap();
 
@@ -153,7 +154,8 @@ pub mod tests {
         credentials(&mut app, &credential_configuration_id).await;
         let grants = offers(&mut app, &credential_configuration_id).await.unwrap();
 
-        let authorization_state = authorization_state(&InMemory, Service::default(), Default::default()).await;
+        let authorization_state =
+            Arc::new(authorization_state(&InMemory, Service::default(), Default::default()).await);
 
         agent_authorization::state::initialize(&authorization_state)
             .await
diff --git a/agent_api_rest/src/authorization/mod.rs b/agent_api_rest/src/authorization/mod.rs
index 5b97b4b9..e4df7671 100644
--- a/agent_api_rest/src/authorization/mod.rs
+++ b/agent_api_rest/src/authorization/mod.rs
@@ -9,8 +9,9 @@ use agent_issuance::state::IssuanceState;
 use authorization_server::{authorize::authorize, par::par, token::token};
 use axum::routing::get;
 use axum::{routing::post, Router};
+use std::sync::Arc;
 
-pub fn router((authorization_state, issuance_state): (AuthorizationState, IssuanceState)) -> Router {
+pub fn router((authorization_state, issuance_state): (Arc<AuthorizationState>, Arc<IssuanceState>)) -> Router {
     Router::new()
         .nest(API_VERSION, Router::new())
         .route("/auth/consent", get(get_consent).post(post_consent))
diff --git a/agent_api_rest/src/holder/holder/credentials/mod.rs b/agent_api_rest/src/holder/holder/credentials/mod.rs
index bcff586a..d26ae8d7 100644
--- a/agent_api_rest/src/holder/holder/credentials/mod.rs
+++ b/agent_api_rest/src/holder/holder/credentials/mod.rs
@@ -9,9 +9,10 @@ use http_api_problem::ApiError;
 use hyper::StatusCode;
 use identity_credential::credential::Jwt;
 use serde::{Deserialize, Serialize};
+use std::sync::Arc;
 
 #[axum_macros::debug_handler]
-pub(crate) async fn credentials(State(state): State<HolderState>) -> Result<Response, ApiError> {
+pub(crate) async fn credentials(State(state): State<Arc<HolderState>>) -> Result<Response, ApiError> {
     let all_credentials = query_handler("all_holder_credentials", &state.query.all_holder_credentials)
         .await?
         .map(|all_credentials_view| all_credentials_view.credentials.into_values().collect::<Vec<_>>())
@@ -28,7 +29,7 @@ pub struct HolderCredentialsEndpointRequest {
 
 #[axum_macros::debug_handler]
 pub(crate) async fn post_credentials(
-    State(state): State<HolderState>,
+    State(state): State<Arc<HolderState>>,
     Json(HolderCredentialsEndpointRequest { credential }): Json<HolderCredentialsEndpointRequest>,
 ) -> Result<Response, ApiError> {
     let holder_credential_id = uuid::Uuid::new_v4().to_string();
@@ -50,7 +51,7 @@ pub(crate) async fn post_credentials(
 
 #[axum_macros::debug_handler]
 pub(crate) async fn credential(
-    State(state): State<HolderState>,
+    State(state): State<Arc<HolderState>>,
     Path(holder_credential_id): Path<String>,
 ) -> Result<Response, ApiError> {
     query_handler(&holder_credential_id, &state.query.holder_credential)
diff --git a/agent_api_rest/src/holder/holder/offers/accept.rs b/agent_api_rest/src/holder/holder/offers/accept.rs
index 018640d1..0ab407ef 100644
--- a/agent_api_rest/src/holder/holder/offers/accept.rs
+++ b/agent_api_rest/src/holder/holder/offers/accept.rs
@@ -11,10 +11,11 @@ use axum::{
 };
 use http_api_problem::ApiError;
 use hyper::StatusCode;
+use std::sync::Arc;
 
 #[axum_macros::debug_handler]
 pub(crate) async fn accept(
-    State(state): State<HolderState>,
+    State(state): State<Arc<HolderState>>,
     Path(received_offer_id): Path<String>,
 ) -> Result<Response, ApiError> {
     // TODO: General note that also applies to other endpoints: currently we are using Application Layer logic in the
diff --git a/agent_api_rest/src/holder/holder/offers/mod.rs b/agent_api_rest/src/holder/holder/offers/mod.rs
index c6f292a8..0c1fc8ce 100644
--- a/agent_api_rest/src/holder/holder/offers/mod.rs
+++ b/agent_api_rest/src/holder/holder/offers/mod.rs
@@ -10,9 +10,10 @@ use axum::{
 };
 use http_api_problem::ApiError;
 use hyper::StatusCode;
+use std::sync::Arc;
 
 #[axum_macros::debug_handler]
-pub(crate) async fn offers(State(state): State<HolderState>) -> Result<Response, ApiError> {
+pub(crate) async fn offers(State(state): State<Arc<HolderState>>) -> Result<Response, ApiError> {
     let all_received_offers = query_handler("all_received_offers", &state.query.all_received_offers)
         .await?
         .map(|all_received_offers_view| {
@@ -28,7 +29,7 @@ pub(crate) async fn offers(State(state): State<HolderState>) -> Result<Response,
 
 #[axum_macros::debug_handler]
 pub(crate) async fn offer(
-    State(state): State<HolderState>,
+    State(state): State<Arc<HolderState>>,
     Path(received_offer_id): Path<String>,
 ) -> Result<Response, ApiError> {
     query_handler(&received_offer_id, &state.query.received_offer)
diff --git a/agent_api_rest/src/holder/holder/offers/reject.rs b/agent_api_rest/src/holder/holder/offers/reject.rs
index f41246cf..315eb00c 100644
--- a/agent_api_rest/src/holder/holder/offers/reject.rs
+++ b/agent_api_rest/src/holder/holder/offers/reject.rs
@@ -6,10 +6,11 @@ use axum::{
 };
 use http_api_problem::ApiError;
 use hyper::StatusCode;
+use std::sync::Arc;
 
 #[axum_macros::debug_handler]
 pub(crate) async fn reject(
-    State(state): State<HolderState>,
+    State(state): State<Arc<HolderState>>,
     Path(received_offer_id): Path<String>,
 ) -> Result<Response, ApiError> {
     let command = OfferCommand::RejectCredentialOffer {
diff --git a/agent_api_rest/src/holder/holder/presentations/mod.rs b/agent_api_rest/src/holder/holder/presentations/mod.rs
index 72ab9bed..3129e779 100644
--- a/agent_api_rest/src/holder/holder/presentations/mod.rs
+++ b/agent_api_rest/src/holder/holder/presentations/mod.rs
@@ -12,9 +12,10 @@ use axum::{
 use http_api_problem::ApiError;
 use hyper::StatusCode;
 use serde::{Deserialize, Serialize};
+use std::sync::Arc;
 
 #[axum_macros::debug_handler]
-pub(crate) async fn get_presentations(State(state): State<HolderState>) -> Result<Response, ApiError> {
+pub(crate) async fn get_presentations(State(state): State<Arc<HolderState>>) -> Result<Response, ApiError> {
     let all_presentations = query_handler("all_presentations", &state.query.all_presentations)
         .await?
         .map(|all_presentations_view| all_presentations_view.presentations.into_values().collect::<Vec<_>>())
@@ -25,7 +26,7 @@ pub(crate) async fn get_presentations(State(state): State<HolderState>) -> Resul
 
 #[axum_macros::debug_handler]
 pub(crate) async fn presentation(
-    State(state): State<HolderState>,
+    State(state): State<Arc<HolderState>>,
     Path(presentation_id): Path<String>,
 ) -> Result<Response, ApiError> {
     query_handler(&presentation_id, &state.query.presentation)
@@ -42,7 +43,7 @@ pub struct PresentationsEndpointRequest {
 
 #[axum_macros::debug_handler]
 pub(crate) async fn post_presentations(
-    State(state): State<HolderState>,
+    State(state): State<Arc<HolderState>>,
     Json(PresentationsEndpointRequest { credential_ids }): Json<PresentationsEndpointRequest>,
 ) -> Result<Response, ApiError> {
     let mut credentials = vec![];
diff --git a/agent_api_rest/src/holder/holder/presentations/presentation_signed.rs b/agent_api_rest/src/holder/holder/presentations/presentation_signed.rs
index 0b232616..9ffe6bbb 100644
--- a/agent_api_rest/src/holder/holder/presentations/presentation_signed.rs
+++ b/agent_api_rest/src/holder/holder/presentations/presentation_signed.rs
@@ -6,10 +6,11 @@ use axum::{
 };
 use http_api_problem::ApiError;
 use hyper::{header, StatusCode};
+use std::sync::Arc;
 
 #[axum_macros::debug_handler]
 pub(crate) async fn presentation_signed(
-    State(state): State<HolderState>,
+    State(state): State<Arc<HolderState>>,
     Path(presentation_id): Path<String>,
 ) -> Result<Response, ApiError> {
     match query_handler(&presentation_id, &state.query.presentation).await? {
diff --git a/agent_api_rest/src/holder/mod.rs b/agent_api_rest/src/holder/mod.rs
index 0604aa78..1dbb3071 100644
--- a/agent_api_rest/src/holder/mod.rs
+++ b/agent_api_rest/src/holder/mod.rs
@@ -17,8 +17,9 @@ use holder::{
     credentials::{credential, post_credentials},
     presentations::{get_presentations, post_presentations, presentation, presentation_signed::presentation_signed},
 };
+use std::sync::Arc;
 
-pub fn router(holder_state: HolderState) -> Router {
+pub fn router(holder_state: Arc<HolderState>) -> Router {
     Router::new()
         .nest(
             API_VERSION,
diff --git a/agent_api_rest/src/holder/openid4vci/mod.rs b/agent_api_rest/src/holder/openid4vci/mod.rs
index f68e7b6c..ea9ef526 100644
--- a/agent_api_rest/src/holder/openid4vci/mod.rs
+++ b/agent_api_rest/src/holder/openid4vci/mod.rs
@@ -9,11 +9,12 @@ use http_api_problem::ApiError;
 use hyper::StatusCode;
 use oid4vci::credential_offer::CredentialOffer;
 use serde_json::Value;
+use std::sync::Arc;
 use tracing::info;
 
 #[axum_macros::debug_handler]
 pub(crate) async fn offers_params(
-    State(state): State<HolderState>,
+    State(state): State<Arc<HolderState>>,
     // TODO: Can this be changed to `StringifiedForm`?
     Form(payload): Form<serde_json::Value>,
 ) -> Result<Response, ApiError> {
diff --git a/agent_api_rest/src/identity/connections/mod.rs b/agent_api_rest/src/identity/connections/mod.rs
index e3b82529..42acf1f6 100644
--- a/agent_api_rest/src/identity/connections/mod.rs
+++ b/agent_api_rest/src/identity/connections/mod.rs
@@ -1,3 +1,5 @@
+use std::sync::Arc;
+
 use crate::handlers::{command_handler, query_handler};
 use crate::API_VERSION;
 use agent_identity::{connection::command::ConnectionCommand, state::IdentityState};
@@ -28,7 +30,7 @@ pub struct PostConnectionsEndpointRequest {
 
 #[axum_macros::debug_handler]
 pub(crate) async fn post_connections(
-    State(state): State<IdentityState>,
+    State(state): State<Arc<IdentityState>>,
     Json(PostConnectionsEndpointRequest {
         alias,
         domain,
@@ -76,7 +78,7 @@ pub struct GetConnectionsEndpointRequest {
 
 #[axum_macros::debug_handler]
 pub(crate) async fn get_connections(
-    State(state): State<IdentityState>,
+    State(state): State<Arc<IdentityState>>,
     Form(GetConnectionsEndpointRequest { alias, domain, did }): Form<GetConnectionsEndpointRequest>,
 ) -> Result<Response, ApiError> {
     debug!("Request Params - alias: {alias:?}, domain: {domain:?}, did: {did:?}");
@@ -107,7 +109,7 @@ pub(crate) async fn get_connections(
 
 #[axum_macros::debug_handler]
 pub(crate) async fn get_connection(
-    State(state): State<IdentityState>,
+    State(state): State<Arc<IdentityState>>,
     Path(connection_id): Path<String>,
 ) -> Result<Response, ApiError> {
     query_handler(&connection_id, &state.query.connection)
diff --git a/agent_api_rest/src/identity/documents/mod.rs b/agent_api_rest/src/identity/documents/mod.rs
index 2c757a09..adf3ac62 100644
--- a/agent_api_rest/src/identity/documents/mod.rs
+++ b/agent_api_rest/src/identity/documents/mod.rs
@@ -9,6 +9,7 @@ use axum::{
 use http_api_problem::ApiError;
 use hyper::StatusCode;
 use serde::{Deserialize, Serialize};
+use std::sync::Arc;
 use tracing::debug;
 
 #[derive(Deserialize, Serialize)]
@@ -18,7 +19,7 @@ pub struct GetDocumentsEndpoint {
 }
 
 pub(crate) async fn get_documents(
-    State(state): State<IdentityState>,
+    State(state): State<Arc<IdentityState>>,
     Form(GetDocumentsEndpoint { did_method }): Form<GetDocumentsEndpoint>,
 ) -> Result<Response, ApiError> {
     debug!("Request Params - did_method: {did_method:?}");
@@ -45,7 +46,7 @@ pub(crate) async fn get_documents(
 
 #[axum_macros::debug_handler]
 pub(crate) async fn get_document(
-    State(state): State<IdentityState>,
+    State(state): State<Arc<IdentityState>>,
     Path(document_id): Path<String>,
 ) -> Result<Response, ApiError> {
     query_handler(&document_id, &state.query.document)
diff --git a/agent_api_rest/src/identity/mod.rs b/agent_api_rest/src/identity/mod.rs
index f3cbfe6b..6060268b 100644
--- a/agent_api_rest/src/identity/mod.rs
+++ b/agent_api_rest/src/identity/mod.rs
@@ -6,6 +6,8 @@ pub mod well_known;
 
 pub mod error;
 
+use std::sync::Arc;
+
 use agent_identity::state::IdentityState;
 use axum::{
     routing::{get, post},
@@ -21,7 +23,7 @@ use crate::{
     API_VERSION,
 };
 
-pub fn router(identity_state: IdentityState) -> Router {
+pub fn router(identity_state: Arc<IdentityState>) -> Router {
     Router::new()
         .nest(
             API_VERSION,
diff --git a/agent_api_rest/src/identity/profiles/mod.rs b/agent_api_rest/src/identity/profiles/mod.rs
index 509964e6..521b0727 100644
--- a/agent_api_rest/src/identity/profiles/mod.rs
+++ b/agent_api_rest/src/identity/profiles/mod.rs
@@ -15,6 +15,7 @@ use http_api_problem::ApiError;
 use hyper::StatusCode;
 use serde::{Deserialize, Serialize};
 use serde_with::skip_serializing_none;
+use std::sync::Arc;
 
 #[derive(Deserialize, Serialize)]
 #[serde(rename_all = "camelCase")]
@@ -29,7 +30,7 @@ pub struct PatchProfileEndpointRequest {
 
 #[axum_macros::debug_handler]
 pub(crate) async fn patch_profile(
-    State(state): State<IdentityState>,
+    State(state): State<Arc<IdentityState>>,
     Json(PatchProfileEndpointRequest {
         display_name,
         logo,
@@ -81,7 +82,7 @@ struct GetProfileEndpointResponse {
 }
 
 #[axum_macros::debug_handler]
-pub(crate) async fn get_profile(State(state): State<IdentityState>) -> Result<Response, ApiError> {
+pub(crate) async fn get_profile(State(state): State<Arc<IdentityState>>) -> Result<Response, ApiError> {
     query_handler(PROFILE_ID, &state.query.profile)
         .await?
         .map(|profile_view| {
diff --git a/agent_api_rest/src/identity/services/linked_vp.rs b/agent_api_rest/src/identity/services/linked_vp.rs
index 6d258717..db5c1a78 100644
--- a/agent_api_rest/src/identity/services/linked_vp.rs
+++ b/agent_api_rest/src/identity/services/linked_vp.rs
@@ -13,6 +13,7 @@ use axum::{
 use http_api_problem::ApiError;
 use hyper::StatusCode;
 use serde::{Deserialize, Serialize};
+use std::sync::Arc;
 
 #[derive(Deserialize, Serialize)]
 #[serde(rename_all = "camelCase")]
@@ -22,7 +23,7 @@ pub struct LinkedVPEndpointRequest {
 
 #[axum_macros::debug_handler]
 pub(crate) async fn linked_vp(
-    State(state): State<IdentityState>,
+    State(state): State<Arc<IdentityState>>,
     Json(LinkedVPEndpointRequest { presentation_ids }): Json<LinkedVPEndpointRequest>,
 ) -> Result<Response, ApiError> {
     let service_id = "linked-verifiable-presentation-service".to_string();
diff --git a/agent_api_rest/src/identity/services/mod.rs b/agent_api_rest/src/identity/services/mod.rs
index 3cd2a767..ce81bf4f 100644
--- a/agent_api_rest/src/identity/services/mod.rs
+++ b/agent_api_rest/src/identity/services/mod.rs
@@ -9,9 +9,10 @@ use axum::{
 };
 use http_api_problem::ApiError;
 use hyper::StatusCode;
+use std::sync::Arc;
 
 #[axum_macros::debug_handler]
-pub(crate) async fn services(State(state): State<IdentityState>) -> Result<Response, ApiError> {
+pub(crate) async fn services(State(state): State<Arc<IdentityState>>) -> Result<Response, ApiError> {
     let all_services = query_handler("all_services", &state.query.all_services)
         .await?
         .map(|all_services_view| all_services_view.services.into_values().collect::<Vec<_>>())
@@ -22,7 +23,7 @@ pub(crate) async fn services(State(state): State<IdentityState>) -> Result<Respo
 
 #[axum_macros::debug_handler]
 pub(crate) async fn service(
-    State(state): State<IdentityState>,
+    State(state): State<Arc<IdentityState>>,
     Path(service_id): Path<String>,
 ) -> Result<Response, ApiError> {
     query_handler(&service_id, &state.query.service)
diff --git a/agent_api_rest/src/identity/well_known/did.rs b/agent_api_rest/src/identity/well_known/did.rs
index a3d53b12..e8299e9c 100644
--- a/agent_api_rest/src/identity/well_known/did.rs
+++ b/agent_api_rest/src/identity/well_known/did.rs
@@ -8,9 +8,10 @@ use axum::{
 };
 use http_api_problem::ApiError;
 use hyper::StatusCode;
+use std::sync::Arc;
 
 #[axum_macros::debug_handler]
-pub(crate) async fn did(State(state): State<IdentityState>) -> Result<Response, ApiError> {
+pub(crate) async fn did(State(state): State<Arc<IdentityState>>) -> Result<Response, ApiError> {
     query_handler("all_documents", &state.query.all_documents)
         .await?
         .and_then(|all_documents_view| {
diff --git a/agent_api_rest/src/identity/well_known/did_configuration.rs b/agent_api_rest/src/identity/well_known/did_configuration.rs
index bf70b91c..95ae9840 100644
--- a/agent_api_rest/src/identity/well_known/did_configuration.rs
+++ b/agent_api_rest/src/identity/well_known/did_configuration.rs
@@ -10,9 +10,10 @@ use axum::{
 };
 use http_api_problem::ApiError;
 use hyper::StatusCode;
+use std::sync::Arc;
 
 #[axum_macros::debug_handler]
-pub(crate) async fn did_configuration(State(state): State<IdentityState>) -> Result<Response, ApiError> {
+pub(crate) async fn did_configuration(State(state): State<Arc<IdentityState>>) -> Result<Response, ApiError> {
     // Get the DID Configuration Resource if it exists.
     match query_handler(DOMAIN_LINKAGE_SERVICE_ID, &state.query.service).await? {
         Some(ServiceView {
diff --git a/agent_api_rest/src/issuance/credential_configurations.rs b/agent_api_rest/src/issuance/credential_configurations.rs
deleted file mode 100644
index 84274291..00000000
--- a/agent_api_rest/src/issuance/credential_configurations.rs
+++ /dev/null
@@ -1,25 +0,0 @@
-use crate::handlers::command_handler;
-use agent_issuance::server_config::command::ServerConfigCommand;
-use agent_issuance::state::{IssuanceState, SERVER_CONFIG_ID};
-use agent_shared::config::CredentialConfiguration;
-use axum::{
-    extract::{Json, State},
-    http::StatusCode,
-    response::{IntoResponse, Response},
-};
-use http_api_problem::ApiError;
-
-#[axum_macros::debug_handler]
-pub(crate) async fn credential_configurations(
-    State(state): State<IssuanceState>,
-    Json(credential_configuration): Json<CredentialConfiguration>,
-) -> Result<Response, ApiError> {
-    let command = ServerConfigCommand::UpdateCredentialConfiguration {
-        credential_configuration: credential_configuration.clone(),
-        provisioned: false,
-    };
-
-    command_handler(SERVER_CONFIG_ID, &state.command.server_config, command).await?;
-
-    Ok((StatusCode::CREATED, Json(credential_configuration)).into_response())
-}
diff --git a/agent_api_rest/src/issuance/credential_issuer/credential.rs b/agent_api_rest/src/issuance/credential_issuer/credential.rs
index c511c152..8b0c99f4 100644
--- a/agent_api_rest/src/issuance/credential_issuer/credential.rs
+++ b/agent_api_rest/src/issuance/credential_issuer/credential.rs
@@ -21,6 +21,7 @@ use axum::{
 use axum_auth::AuthBearer;
 use oid4vci::credential_request::CredentialRequest;
 use oid4vci::errors::CredentialErrorResponse;
+use std::sync::Arc;
 use tokio::time::sleep;
 use tracing::error;
 
@@ -28,7 +29,7 @@ const POLLING_INTERVAL_MS: u64 = 100;
 
 #[axum_macros::debug_handler]
 pub(crate) async fn credential(
-    State(state): State<IssuanceState>,
+    State(state): State<Arc<IssuanceState>>,
     AuthBearer(access_token): AuthBearer,
     Json(credential_request): Json<CredentialRequest>,
 ) -> Result<Response, PublicError> {
@@ -351,7 +352,7 @@ pub mod tests {
             (None, Default::default())
         };
 
-        let issuance_state = issuance_state(&InMemory, Service::default(), issuance_event_publishers).await;
+        let issuance_state = Arc::new(issuance_state(&InMemory, Service::default(), issuance_event_publishers).await);
         agent_issuance::state::initialize(&issuance_state).await.unwrap();
 
         let mut issuance_app = router(issuance_state.clone());
@@ -381,7 +382,8 @@ pub mod tests {
 
         let grants = offers(&mut issuance_app, &credential_configuration_id).await.unwrap();
 
-        let authorization_state = authorization_state(&InMemory, Service::default(), Default::default()).await;
+        let authorization_state =
+            Arc::new(authorization_state(&InMemory, Service::default(), Default::default()).await);
         agent_authorization::state::initialize(&authorization_state)
             .await
             .unwrap();
diff --git a/agent_api_rest/src/issuance/credential_issuer/credential_offer.rs b/agent_api_rest/src/issuance/credential_issuer/credential_offer.rs
index 3197e5d6..6ffbe220 100644
--- a/agent_api_rest/src/issuance/credential_issuer/credential_offer.rs
+++ b/agent_api_rest/src/issuance/credential_issuer/credential_offer.rs
@@ -8,10 +8,11 @@ use axum::{
 use http_api_problem::ApiError;
 use hyper::StatusCode;
 use oid4vci::credential_offer::CredentialOffer;
+use std::sync::Arc;
 
 #[axum_macros::debug_handler]
 pub(crate) async fn credential_offer_uri(
-    State(state): State<IssuanceState>,
+    State(state): State<Arc<IssuanceState>>,
     Path(offer_id): Path<String>,
 ) -> Result<Response, ApiError> {
     match query_handler(&offer_id, &state.query.offer).await? {
diff --git a/agent_api_rest/src/issuance/credential_issuer/notification.rs b/agent_api_rest/src/issuance/credential_issuer/notification.rs
index 6c7fb59f..0473688e 100644
--- a/agent_api_rest/src/issuance/credential_issuer/notification.rs
+++ b/agent_api_rest/src/issuance/credential_issuer/notification.rs
@@ -11,6 +11,7 @@ use axum_auth::AuthBearer;
 use oid4vci::errors::NotificationErrorResponse;
 use oid4vci::notification_request::NotificationRequest;
 use serde_json::json;
+use std::sync::Arc;
 
 use tracing::info;
 /// The HTTP response MUST use the HTTP status code 400 (Bad Request) and set the content type to application/json.
@@ -18,7 +19,7 @@ use tracing::info;
 
 #[axum_macros::debug_handler]
 pub async fn notification(
-    State(state): State<IssuanceState>,
+    State(state): State<Arc<IssuanceState>>,
     AuthBearer(access_token): AuthBearer,
     Json(raw_value): Json<serde_json::Value>,
 ) -> Result<Response, PublicError> {
@@ -79,14 +80,15 @@ mod tests {
     #[serial_test::serial]
     #[tokio::test]
     async fn test_valid_notification_request() {
-        let issuance_state = issuance_state(&InMemory, Service::default(), Default::default()).await;
+        let issuance_state = Arc::new(issuance_state(&InMemory, Service::default(), Default::default()).await);
         agent_issuance::state::initialize(&issuance_state).await.unwrap();
         let mut issuance_app = issuance::router(issuance_state.clone());
 
         credentials(&mut issuance_app, "001").await;
         let grants = offers(&mut issuance_app, "001").await.unwrap();
 
-        let authorization_state = authorization_state(&InMemory, Service::default(), Default::default()).await;
+        let authorization_state =
+            Arc::new(authorization_state(&InMemory, Service::default(), Default::default()).await);
         agent_authorization::state::initialize(&authorization_state)
             .await
             .unwrap();
@@ -117,14 +119,15 @@ mod tests {
 
     #[tokio::test]
     async fn test_invalid_notification_request() {
-        let issuance_state = issuance_state(&InMemory, Service::default(), Default::default()).await;
+        let issuance_state = Arc::new(issuance_state(&InMemory, Service::default(), Default::default()).await);
         agent_issuance::state::initialize(&issuance_state).await.unwrap();
         let mut issuance_app = issuance::router(issuance_state.clone());
 
         credentials(&mut issuance_app, "001").await;
         let grants = offers(&mut issuance_app, "001").await.unwrap();
 
-        let authorization_state = authorization_state(&InMemory, Service::default(), Default::default()).await;
+        let authorization_state =
+            Arc::new(authorization_state(&InMemory, Service::default(), Default::default()).await);
         agent_authorization::state::initialize(&authorization_state)
             .await
             .unwrap();
diff --git a/agent_api_rest/src/issuance/credential_issuer/token_status_list.rs b/agent_api_rest/src/issuance/credential_issuer/token_status_list.rs
index 962c0a2e..662b2baa 100644
--- a/agent_api_rest/src/issuance/credential_issuer/token_status_list.rs
+++ b/agent_api_rest/src/issuance/credential_issuer/token_status_list.rs
@@ -1,3 +1,5 @@
+use std::sync::Arc;
+
 use agent_issuance::{
     credential::application::token_status_list_service::TokenStatusListService, state::IssuanceState,
 };
@@ -12,12 +14,12 @@ use oauth_tsl::relying_party::StatusListTokenResponseType;
 use crate::issuance::error::PublicError;
 
 pub async fn token_status_list(
-    State(state): State<IssuanceState>,
+    State(state): State<Arc<IssuanceState>>,
     Path(status_list_number): Path<usize>,
 ) -> Result<Response, PublicError> {
     let token_status_list_service = TokenStatusListService {};
     let compressed_jwt_token = token_status_list_service
-        .create_gzip_status_list_jwt_token(status_list_number, state)
+        .create_gzip_status_list_jwt_token(status_list_number, &state)
         .await
         .map_err(|_| PublicError::InternalServerError)?;
 
@@ -37,6 +39,8 @@ pub async fn token_status_list(
 
 #[cfg(test)]
 pub mod tests {
+    use std::sync::Arc;
+
     use agent_issuance::state::initialize;
     use agent_secret_manager::{service::Service, subject::Subject};
     use agent_shared::config::{config, BITS_PER_STATUS, STATUS_LIST_BYTES_AMOUNT};
@@ -57,7 +61,7 @@ pub mod tests {
     /// The remainder of the test breaks down the Token Status List response in various steps and checks these steps one by one.
     #[tokio::test]
     pub async fn test_token_status_list() {
-        let issuance_state = issuance_state(&InMemory, Service::default(), Default::default()).await;
+        let issuance_state = Arc::new(issuance_state(&InMemory, Service::default(), Default::default()).await);
         initialize(&issuance_state).await.unwrap();
 
         let relying_party_state = Subject::default();
diff --git a/agent_api_rest/src/issuance/credential_issuer/well_known/oauth_authorization_server.rs b/agent_api_rest/src/issuance/credential_issuer/well_known/oauth_authorization_server.rs
index acd93e97..ed3da5bc 100644
--- a/agent_api_rest/src/issuance/credential_issuer/well_known/oauth_authorization_server.rs
+++ b/agent_api_rest/src/issuance/credential_issuer/well_known/oauth_authorization_server.rs
@@ -9,10 +9,11 @@ use axum::{
     response::{IntoResponse, Response},
 };
 use http_api_problem::ApiError;
+use std::sync::Arc;
 
 // TODO: move this to `authorization/authorization_server/well_known.rs`!
 #[axum_macros::debug_handler]
-pub(crate) async fn oauth_authorization_server(State(state): State<IssuanceState>) -> Result<Response, ApiError> {
+pub(crate) async fn oauth_authorization_server(State(state): State<Arc<IssuanceState>>) -> Result<Response, ApiError> {
     match query_handler(SERVER_CONFIG_ID, &state.query.server_config).await? {
         Some(ServerConfigView {
             authorization_server_metadata,
@@ -73,7 +74,7 @@ mod tests {
 
     #[tokio::test]
     async fn test_oauth_authorization_server_endpoint() {
-        let issuance_state = issuance_state(&InMemory, Service::default(), Default::default()).await;
+        let issuance_state = Arc::new(issuance_state(&InMemory, Service::default(), Default::default()).await);
         initialize(&issuance_state).await.unwrap();
 
         let mut app = router(issuance_state);
diff --git a/agent_api_rest/src/issuance/credential_issuer/well_known/openid_credential_issuer.rs b/agent_api_rest/src/issuance/credential_issuer/well_known/openid_credential_issuer.rs
index f9f03209..9b7d7d4a 100644
--- a/agent_api_rest/src/issuance/credential_issuer/well_known/openid_credential_issuer.rs
+++ b/agent_api_rest/src/issuance/credential_issuer/well_known/openid_credential_issuer.rs
@@ -11,9 +11,10 @@ use axum::{
 };
 use http_api_problem::ApiError;
 use serde_json::json;
+use std::sync::Arc;
 
 #[axum_macros::debug_handler]
-pub(crate) async fn openid_credential_issuer(State(state): State<IssuanceState>) -> Result<Response, ApiError> {
+pub(crate) async fn openid_credential_issuer(State(state): State<Arc<IssuanceState>>) -> Result<Response, ApiError> {
     match query_handler(SERVER_CONFIG_ID, &state.query.server_config).await? {
         Some(ServerConfigView {
             mut credential_issuer_metadata,
@@ -70,7 +71,7 @@ mod tests {
 
     #[tokio::test]
     async fn test_openid_credential_issuer_endpoint() {
-        let issuance_state = issuance_state(&InMemory, Service::default(), Default::default()).await;
+        let issuance_state = Arc::new(issuance_state(&InMemory, Service::default(), Default::default()).await);
         initialize(&issuance_state).await.unwrap();
 
         let mut app = router(issuance_state);
diff --git a/agent_api_rest/src/issuance/credentials.rs b/agent_api_rest/src/issuance/credentials.rs
index 4210a053..fd2d4b82 100644
--- a/agent_api_rest/src/issuance/credentials.rs
+++ b/agent_api_rest/src/issuance/credentials.rs
@@ -18,13 +18,14 @@ use oauth_tsl::status_list::StatusType;
 use oid4vci::credential_offer::GrantType;
 use serde::{Deserialize, Serialize};
 use serde_json::Value;
+use std::sync::Arc;
 
 #[cfg(feature = "test_utils")]
 pub const TESTINDEX: usize = 123;
 
 #[axum_macros::debug_handler]
 pub(crate) async fn credential(
-    State(state): State<IssuanceState>,
+    State(state): State<Arc<IssuanceState>>,
     Path(credential_id): Path<String>,
 ) -> Result<Response, ApiError> {
     query_handler(&credential_id, &state.query.credential)
@@ -46,7 +47,7 @@ pub struct CredentialsEndpointRequest {
 
 #[axum_macros::debug_handler]
 pub(crate) async fn credentials(
-    State(state): State<IssuanceState>,
+    State(state): State<Arc<IssuanceState>>,
     Json(CredentialsEndpointRequest {
         offer_id,
         credential,
@@ -196,7 +197,7 @@ pub(crate) async fn credentials(
 }
 
 #[axum_macros::debug_handler]
-pub(crate) async fn all_credentials(State(state): State<IssuanceState>) -> Result<Response, ApiError> {
+pub(crate) async fn all_credentials(State(state): State<Arc<IssuanceState>>) -> Result<Response, ApiError> {
     let all_credentials = query_handler("all_credentials", &state.query.all_credentials)
         .await?
         .map(|all_credentials_view| all_credentials_view.credentials.into_values().collect::<Vec<_>>())
@@ -213,7 +214,7 @@ pub struct PatchCredentialEndpointRequest {
 
 /// Currently, this endpoint only supports patching the CredentialStatus of a credential according to the IETF OAuth Token Status List spec.
 pub async fn patch_credential(
-    State(state): State<IssuanceState>,
+    State(state): State<Arc<IssuanceState>>,
     Path(credential_id): Path<String>,
     Json(PatchCredentialEndpointRequest {
         credential_status: status,
@@ -409,7 +410,7 @@ pub mod tests {
 
     #[tokio::test]
     async fn test_patch_credential() {
-        let issuance_state = issuance_state(&InMemory, Service::default(), Default::default()).await;
+        let issuance_state = Arc::new(issuance_state(&InMemory, Service::default(), Default::default()).await);
         initialize(&issuance_state).await.unwrap();
 
         let mut app = router(issuance_state);
@@ -420,7 +421,7 @@ pub mod tests {
     #[tokio::test]
     #[tracing_test::traced_test]
     async fn test_credentials_endpoint() {
-        let issuance_state = issuance_state(&InMemory, Service::default(), Default::default()).await;
+        let issuance_state = Arc::new(issuance_state(&InMemory, Service::default(), Default::default()).await);
         initialize(&issuance_state).await.unwrap();
 
         let mut app = router(issuance_state);
diff --git a/agent_api_rest/src/issuance/error.rs b/agent_api_rest/src/issuance/error.rs
index 2e43d8f1..961856c1 100644
--- a/agent_api_rest/src/issuance/error.rs
+++ b/agent_api_rest/src/issuance/error.rs
@@ -109,20 +109,7 @@ impl IntoApiErrorExt for OfferError {
 
 impl IntoApiErrorExt for ServerConfigError {
     fn into_api_error(self) -> ApiError {
-        use ServerConfigError::*;
-        match self {
-            // UniCore API Problem Details
-            UpdateProvisionedCredentialConfigurationError => ApiError::builder(StatusCode::BAD_REQUEST)
-                .title("Update Provisioned Credential Configuration Error")
-                .type_url(type_url("issuance#update-provisioned-credential-configuration-error"))
-                .source(self)
-                .finish(),
-            RemoveProvisionedCredentialConfigurationError => ApiError::builder(StatusCode::BAD_REQUEST)
-                .title("Remove Provisioned Credential Configuration Error")
-                .type_url(type_url("issuance#remove-provisioned-credential-configuration-error"))
-                .source(self)
-                .finish(),
-        }
+        match self {}
     }
 }
 
@@ -195,11 +182,7 @@ impl IntoPublicError for OfferError {
 
 impl IntoPublicError for ServerConfigError {
     fn into_public_error(self) -> PublicError {
-        use ServerConfigError::*;
-        match self {
-            UpdateProvisionedCredentialConfigurationError => PublicError::InternalServerError,
-            RemoveProvisionedCredentialConfigurationError => PublicError::InternalServerError,
-        }
+        match self {}
     }
 }
 
@@ -338,35 +321,5 @@ pub mod tests {
                 "detail": "Credential Offer does not exist"
             }),
         );
-
-        assert_eq!(
-            into_json_value(
-                ServerConfigError::UpdateProvisionedCredentialConfigurationError
-                    .into_api_error()
-                    .into_axum_response()
-            )
-            .await,
-            json!({
-                "type": format!("{DOCUMENTATION_URL}problem-details/issuance#update-provisioned-credential-configuration-error"),
-                "title": "Update Provisioned Credential Configuration Error",
-                "status": 400,
-                "detail": "Cannot update provisioned credential configuration during runtime"
-            }),
-        );
-
-        assert_eq!(
-            into_json_value(
-                ServerConfigError::RemoveProvisionedCredentialConfigurationError
-                    .into_api_error()
-                    .into_axum_response()
-            )
-            .await,
-            json!({
-                "type": format!("{DOCUMENTATION_URL}problem-details/issuance#remove-provisioned-credential-configuration-error"),
-                "title": "Remove Provisioned Credential Configuration Error",
-                "status": 400,
-                "detail": "Cannot remove provisioned credential configuration during runtime"
-            }),
-        );
     }
 }
diff --git a/agent_api_rest/src/issuance/mod.rs b/agent_api_rest/src/issuance/mod.rs
index 747966d6..ad084731 100644
--- a/agent_api_rest/src/issuance/mod.rs
+++ b/agent_api_rest/src/issuance/mod.rs
@@ -1,4 +1,3 @@
-pub mod credential_configurations;
 pub mod credential_issuer;
 pub mod credentials;
 pub mod offers;
@@ -6,7 +5,6 @@ pub mod offers;
 pub mod error;
 
 use crate::issuance::{
-    credential_configurations::credential_configurations,
     credential_issuer::{
         credential::credential,
         credential_offer::credential_offer_uri,
@@ -23,8 +21,9 @@ use crate::API_VERSION;
 use agent_issuance::state::IssuanceState;
 use axum::routing::get;
 use axum::{routing::post, Router};
+use std::sync::Arc;
 
-pub fn router(issuance_state: IssuanceState) -> Router {
+pub fn router(issuance_state: Arc<IssuanceState>) -> Router {
     Router::new()
         .nest(
             API_VERSION,
@@ -34,7 +33,6 @@ pub fn router(issuance_state: IssuanceState) -> Router {
                     "/credentials/{credential_id}",
                     get(credentials::credential).patch(patch_credential),
                 )
-                .route("/credential-configurations", post(credential_configurations))
                 .route("/offers", post(offers).get(all_offers))
                 .route("/offers/{offer_id}", get(offer))
                 .route("/offers/send", post(send)),
diff --git a/agent_api_rest/src/issuance/offers/mod.rs b/agent_api_rest/src/issuance/offers/mod.rs
index 903fb5e7..b2fc3e11 100644
--- a/agent_api_rest/src/issuance/offers/mod.rs
+++ b/agent_api_rest/src/issuance/offers/mod.rs
@@ -17,6 +17,7 @@ use http_api_problem::ApiError;
 use hyper::header;
 use oid4vci::credential_offer::GrantType;
 use serde::{Deserialize, Serialize};
+use std::sync::Arc;
 
 #[derive(Deserialize, Serialize)]
 #[serde(rename_all = "camelCase")]
@@ -28,7 +29,7 @@ pub struct OffersEndpointRequest {
 
 #[axum_macros::debug_handler]
 pub(crate) async fn offers(
-    State(state): State<IssuanceState>,
+    State(state): State<Arc<IssuanceState>>,
     Json(OffersEndpointRequest {
         offer_id,
         credential_configuration_ids,
@@ -56,8 +57,8 @@ pub(crate) async fn offers(
     }
 
     let authorization = credential_configurations
-        .into_iter()
-        .find_map(|(credential_configuration_id, (_, _, authorization))| {
+        .into_values()
+        .find_map(|(credential_configuration_id, _, authorization)| {
             credential_configuration_ids
                 .contains(&credential_configuration_id)
                 .then_some(authorization)
@@ -103,7 +104,7 @@ pub(crate) async fn offers(
 }
 
 #[axum_macros::debug_handler]
-pub(crate) async fn all_offers(State(state): State<IssuanceState>) -> Result<Response, ApiError> {
+pub(crate) async fn all_offers(State(state): State<Arc<IssuanceState>>) -> Result<Response, ApiError> {
     let all_offers = query_handler("all_offers", &state.query.all_offers)
         .await?
         .map(|all_offers_view| all_offers_view.offers.into_values().collect::<Vec<_>>())
@@ -114,7 +115,7 @@ pub(crate) async fn all_offers(State(state): State<IssuanceState>) -> Result<Res
 
 #[axum_macros::debug_handler]
 pub(crate) async fn offer(
-    State(state): State<IssuanceState>,
+    State(state): State<Arc<IssuanceState>>,
     Path(offer_id): Path<String>,
 ) -> Result<Response, ApiError> {
     query_handler(&offer_id, &state.query.offer)
@@ -218,7 +219,7 @@ pub mod tests {
     #[tokio::test]
     #[tracing_test::traced_test]
     async fn test_offers_endpoint() {
-        let issuance_state = issuance_state(&InMemory, Service::default(), Default::default()).await;
+        let issuance_state = Arc::new(issuance_state(&InMemory, Service::default(), Default::default()).await);
         initialize(&issuance_state).await.unwrap();
 
         let mut app = router(issuance_state);
@@ -232,7 +233,7 @@ pub mod tests {
     #[tracing_test::traced_test]
     async fn test_offers_endpoint_by_reference() {
         set_config().credential_offer_by_value_enabled = false;
-        let issuance_state = issuance_state(&InMemory, Service::default(), Default::default()).await;
+        let issuance_state = Arc::new(issuance_state(&InMemory, Service::default(), Default::default()).await);
         initialize(&issuance_state).await.unwrap();
 
         let mut app = router(issuance_state);
diff --git a/agent_api_rest/src/issuance/offers/send.rs b/agent_api_rest/src/issuance/offers/send.rs
index db5ed948..ef1425d2 100644
--- a/agent_api_rest/src/issuance/offers/send.rs
+++ b/agent_api_rest/src/issuance/offers/send.rs
@@ -8,6 +8,7 @@ use axum::{
 use http_api_problem::ApiError;
 use hyper::StatusCode;
 use serde::{Deserialize, Serialize};
+use std::sync::Arc;
 use url::Url;
 
 #[derive(Deserialize, Serialize)]
@@ -19,7 +20,7 @@ pub struct SendOfferEndpointRequest {
 
 #[axum_macros::debug_handler]
 pub(crate) async fn send(
-    State(state): State<IssuanceState>,
+    State(state): State<Arc<IssuanceState>>,
     Json(SendOfferEndpointRequest { offer_id, target_url }): Json<SendOfferEndpointRequest>,
 ) -> Result<Response, ApiError> {
     let command = OfferCommand::SendCredentialOffer {
diff --git a/agent_api_rest/src/lib.rs b/agent_api_rest/src/lib.rs
index 452a3db9..aaeac8fe 100644
--- a/agent_api_rest/src/lib.rs
+++ b/agent_api_rest/src/lib.rs
@@ -27,7 +27,7 @@ use axum::{
 };
 use http_body_util::BodyExt as _;
 use hyper::StatusCode;
-use std::time::Duration;
+use std::{sync::Arc, time::Duration};
 use tower::ServiceBuilder;
 use tower_http::trace::TraceLayer;
 use tracing::{debug, info, info_span, Span};
@@ -38,12 +38,12 @@ pub const DOCUMENTATION_URL: &str = "https://beta.docs.impierce.com/unicore/";
 
 #[derive(Default)]
 pub struct ApplicationState {
-    pub identity_state: Option<IdentityState>,
-    pub library_state: Option<LibraryState>,
-    pub authorization_state: Option<AuthorizationState>,
-    pub issuance_state: Option<IssuanceState>,
-    pub holder_state: Option<HolderState>,
-    pub verification_state: Option<VerificationState>,
+    pub identity_state: Option<Arc<IdentityState>>,
+    pub library_state: Option<Arc<LibraryState>>,
+    pub authorization_state: Option<Arc<AuthorizationState>>,
+    pub issuance_state: Option<Arc<IssuanceState>>,
+    pub holder_state: Option<Arc<HolderState>>,
+    pub verification_state: Option<Arc<VerificationState>>,
 }
 
 pub fn app(
diff --git a/agent_api_rest/src/library/mod.rs b/agent_api_rest/src/library/mod.rs
index bf6ab91b..a9053377 100644
--- a/agent_api_rest/src/library/mod.rs
+++ b/agent_api_rest/src/library/mod.rs
@@ -3,13 +3,14 @@ pub mod templates;
 
 use agent_library::state::LibraryState;
 use axum::{routing::get, Router};
+use std::sync::Arc;
 
 use crate::{
     library::templates::{get_template, get_templates, patch_template, post_templates},
     API_VERSION,
 };
 
-pub fn router(library_state: LibraryState) -> Router {
+pub fn router(library_state: Arc<LibraryState>) -> Router {
     Router::new()
         .nest(
             API_VERSION,
diff --git a/agent_api_rest/src/library/templates/mod.rs b/agent_api_rest/src/library/templates/mod.rs
index bf7f809c..a29e28bd 100644
--- a/agent_api_rest/src/library/templates/mod.rs
+++ b/agent_api_rest/src/library/templates/mod.rs
@@ -1,8 +1,9 @@
 use crate::handlers::{command_handler, query_handler};
 use crate::API_VERSION;
 use agent_library::state::LibraryState;
-pub use agent_library::template::aggregate::{CredentialFormat, Display, HolderType, Status, Visibility};
+use agent_library::template::aggregate::{CredentialFormat, Display, HolderType, Status, Template, Visibility};
 use agent_library::template::command::TemplateCommand;
+use agent_library::template::event::Authorization;
 use axum::{
     extract::{Path, State},
     response::{IntoResponse, Response},
@@ -11,12 +12,53 @@ use axum::{
 use http_api_problem::ApiError;
 use hyper::{header, StatusCode};
 use serde::{Deserialize, Serialize};
+use std::sync::Arc;
 use tracing::debug;
 
+/// Data transfer object for Templates.
+#[derive(Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct TemplateDto {
+    #[serde(rename = "id")]
+    pub template_id: String,
+    pub title: Option<String>,
+    pub display: Option<Display>,
+    pub credential_format: Option<CredentialFormat>,
+    pub creator: Option<String>,
+    pub holder_type: Option<HolderType>,
+    pub modified_at: Option<String>,
+    pub tags: Vec<String>,
+    pub status: Status,
+    pub visibility: Visibility,
+    pub description: Option<String>,
+    pub r#type: Vec<String>,
+    pub schema: Option<serde_json::Value>,
+}
+
+impl From<Template> for TemplateDto {
+    fn from(value: Template) -> Self {
+        Self {
+            template_id: value.template_id,
+            title: value.title,
+            display: value.display,
+            credential_format: value.credential_format,
+            creator: value.creator,
+            holder_type: value.holder_type,
+            modified_at: value.modified_at,
+            tags: value.tags,
+            status: value.status,
+            visibility: value.visibility,
+            description: value.description,
+            r#type: value.r#type,
+            schema: value.schema,
+        }
+    }
+}
+
 #[derive(Deserialize, Serialize, Default)]
 #[serde(default, rename_all = "camelCase")]
 pub struct PostTemplatesEndpointRequest {
-    pub title: Option<String>,
+    pub title: String,
     pub display: Option<Display>,
     pub credential_format: Option<CredentialFormat>,
     pub creator: Option<String>,
@@ -25,13 +67,14 @@ pub struct PostTemplatesEndpointRequest {
     pub status: Status,
     pub visibility: Visibility,
     pub description: Option<String>,
+    pub authorization: Option<Authorization>,
     pub r#type: Vec<String>,
     pub schema: Option<serde_json::Value>,
 }
 
 #[axum_macros::debug_handler]
 pub(crate) async fn post_templates(
-    State(state): State<LibraryState>,
+    State(state): State<Arc<LibraryState>>,
     Json(PostTemplatesEndpointRequest {
         title,
         display,
@@ -42,6 +85,7 @@ pub(crate) async fn post_templates(
         status,
         visibility,
         description,
+        authorization,
         r#type,
         schema,
     }): Json<PostTemplatesEndpointRequest>,
@@ -59,6 +103,7 @@ pub(crate) async fn post_templates(
         status,
         visibility,
         description,
+        authorization: authorization.unwrap_or_default(),
         r#type,
         schema,
     };
@@ -72,7 +117,7 @@ pub(crate) async fn post_templates(
             (
                 StatusCode::CREATED,
                 [(header::LOCATION, &format!("{API_VERSION}/templates/{template_id}"))],
-                Json(template_view),
+                Json(TemplateDto::from(template_view)),
             )
                 .into_response()
         })
@@ -98,7 +143,7 @@ pub struct PatchTemplatesEndpointRequest {
 
 #[axum_macros::debug_handler]
 pub(crate) async fn patch_template(
-    State(state): State<LibraryState>,
+    State(state): State<Arc<LibraryState>>,
     Path(template_id): Path<String>,
     Json(PatchTemplatesEndpointRequest {
         title,
@@ -213,7 +258,7 @@ pub struct GetTemplatesEndpointRequest {
 
 #[axum_macros::debug_handler]
 pub(crate) async fn get_templates(
-    State(state): State<LibraryState>,
+    State(state): State<Arc<LibraryState>>,
     Form(GetTemplatesEndpointRequest {}): Form<GetTemplatesEndpointRequest>,
 ) -> Result<Response, ApiError> {
     debug!("Request Params - ");
@@ -221,12 +266,13 @@ pub(crate) async fn get_templates(
     let filtered_templates = query_handler("all_templates", &state.query.all_templates)
         .await?
         .map(|all_templates_view| {
-            let filtered_templates: Vec<_> = all_templates_view
+            let filtered_templates: Vec<TemplateDto> = all_templates_view
                 .templates
                 .into_values()
                 .filter(|_template|
                     // TODO: Apply filtering logic based on request parameters
                     true)
+                .map(TemplateDto::from)
                 .collect();
 
             filtered_templates
@@ -238,11 +284,47 @@ pub(crate) async fn get_templates(
 
 #[axum_macros::debug_handler]
 pub(crate) async fn get_template(
-    State(state): State<LibraryState>,
+    State(state): State<Arc<LibraryState>>,
     Path(template_id): Path<String>,
 ) -> Result<Response, ApiError> {
     query_handler(&template_id, &state.query.template)
         .await?
-        .map(|template_view| (StatusCode::OK, Json(template_view)).into_response())
+        .map(|template_view| (StatusCode::OK, Json(TemplateDto::from(template_view))).into_response())
         .ok_or_else(|| ApiError::new(StatusCode::NOT_FOUND))
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use {Display, Template};
+
+    #[test]
+    fn test_template_response_serialization() {
+        let template = Template {
+            template_id: "test-id".to_string(),
+            title: Some("Test Title".to_string()),
+            display: Some(Display {
+                name: "Test Display".to_string(),
+                logo: None,
+            }),
+            credential_format: None,
+            creator: None,
+            holder_type: Some(HolderType::Individual),
+            modified_at: None,
+            tags: vec![],
+            status: Default::default(),
+            visibility: Default::default(),
+            description: None,
+            authorization: Default::default(),
+            r#type: vec![],
+            schema: None,
+        };
+
+        let response = TemplateDto::from(template);
+        let json = serde_json::json!(&response);
+
+        assert_eq!(json["id"], "test-id");
+        assert_eq!(json["title"], "Test Title");
+        assert_eq!(json["holderType"], "individual");
+    }
+}
diff --git a/agent_api_rest/src/verification/authorization_requests.rs b/agent_api_rest/src/verification/authorization_requests.rs
index 567b1381..8dc16179 100644
--- a/agent_api_rest/src/verification/authorization_requests.rs
+++ b/agent_api_rest/src/verification/authorization_requests.rs
@@ -14,9 +14,12 @@ use http_api_problem::ApiError;
 use hyper::header;
 use oid4vp::dcql::dcql_query::DcqlQuery;
 use serde::{Deserialize, Serialize};
+use std::sync::Arc;
 
 #[axum_macros::debug_handler]
-pub(crate) async fn all_authorization_requests(State(state): State<VerificationState>) -> Result<Response, ApiError> {
+pub(crate) async fn all_authorization_requests(
+    State(state): State<Arc<VerificationState>>,
+) -> Result<Response, ApiError> {
     let all_authorization_requests =
         query_handler("all_authorization_requests", &state.query.all_authorization_requests)
             .await?
@@ -33,7 +36,7 @@ pub(crate) async fn all_authorization_requests(State(state): State<VerificationS
 
 #[axum_macros::debug_handler]
 pub(crate) async fn authorization_request(
-    State(state): State<VerificationState>,
+    State(state): State<Arc<VerificationState>>,
     Path(authorization_request_id): Path<String>,
 ) -> Result<Response, ApiError> {
     query_handler(&authorization_request_id, &state.query.authorization_request)
@@ -51,7 +54,7 @@ pub struct AuthorizationRequestsEndpointRequest {
 
 #[axum_macros::debug_handler]
 pub(crate) async fn authorization_requests(
-    State(verification_state): State<VerificationState>,
+    State(verification_state): State<Arc<VerificationState>>,
     Json(AuthorizationRequestsEndpointRequest {
         nonce,
         state,
@@ -193,7 +196,7 @@ pub mod tests {
     #[tracing_test::traced_test]
     #[tokio::test]
     async fn test_authorization_requests_endpoint() {
-        let verification_state = verification_state(&InMemory, Service::default(), Default::default()).await;
+        let verification_state = Arc::new(verification_state(&InMemory, Service::default(), Default::default()).await);
         let mut app = router(verification_state);
 
         let result = authorization_requests(&mut app).await;
diff --git a/agent_api_rest/src/verification/mod.rs b/agent_api_rest/src/verification/mod.rs
index a1bede8b..99e558a5 100644
--- a/agent_api_rest/src/verification/mod.rs
+++ b/agent_api_rest/src/verification/mod.rs
@@ -7,6 +7,7 @@ use agent_verification::state::VerificationState;
 use authorization_requests::all_authorization_requests;
 use axum::routing::get;
 use axum::{routing::post, Router};
+use std::sync::Arc;
 
 use crate::verification::{
     authorization_requests::authorization_request, authorization_requests::authorization_requests,
@@ -14,7 +15,7 @@ use crate::verification::{
 };
 use crate::API_VERSION;
 
-pub fn router(verification_state: VerificationState) -> Router {
+pub fn router(verification_state: Arc<VerificationState>) -> Router {
     Router::new()
         .nest(
             API_VERSION,
diff --git a/agent_api_rest/src/verification/relying_party/redirect.rs b/agent_api_rest/src/verification/relying_party/redirect.rs
index 7ff33291..3d4c85e0 100644
--- a/agent_api_rest/src/verification/relying_party/redirect.rs
+++ b/agent_api_rest/src/verification/relying_party/redirect.rs
@@ -11,10 +11,11 @@ use axum::{
 };
 use http_api_problem::ApiError;
 use oid4vc_core::utils::form_urlencoded::from_form_urlencoded_string;
+use std::sync::Arc;
 
 #[axum_macros::debug_handler]
 pub(crate) async fn redirect(
-    State(verification_state): State<VerificationState>,
+    State(verification_state): State<Arc<VerificationState>>,
     body: String,
 ) -> Result<Response, ApiError> {
     let authorization_response: GenericAuthorizationResponse = from_form_urlencoded_string(&body).map_err(|e| {
@@ -157,7 +158,7 @@ pub mod tests {
 
         let event_publishers = vec![Box::new(EventPublisherHttp::load().unwrap()) as Box<dyn EventPublisher>];
 
-        let verification_state = verification_state(&InMemory, Service::default(), event_publishers).await;
+        let verification_state = Arc::new(verification_state(&InMemory, Service::default(), event_publishers).await);
 
         let mut app = router(verification_state);
 
diff --git a/agent_api_rest/src/verification/relying_party/request.rs b/agent_api_rest/src/verification/relying_party/request.rs
index ea91844f..ed79eb9c 100644
--- a/agent_api_rest/src/verification/relying_party/request.rs
+++ b/agent_api_rest/src/verification/relying_party/request.rs
@@ -7,13 +7,14 @@ use axum::{
 };
 use http_api_problem::ApiError;
 use hyper::header;
+use std::sync::Arc;
 
 /// Instead of directly embedding the Authorization Request into a QR-code or deeplink, the `Relying Party` can embed a
 /// `request_uri` that points to this endpoint from where the Authorization Request Object can be retrieved.
 /// As described here: https://www.rfc-editor.org/rfc/rfc9101.html#name-passing-a-request-object-by-
 #[axum_macros::debug_handler]
 pub(crate) async fn request(
-    State(verification_state): State<VerificationState>,
+    State(verification_state): State<Arc<VerificationState>>,
     Path(request_id): Path<String>,
 ) -> Result<Response, ApiError> {
     query_handler(&request_id, &verification_state.query.authorization_request)
@@ -73,7 +74,7 @@ pub mod tests {
     #[tokio::test]
     #[tracing_test::traced_test]
     async fn test_request_endpoint() {
-        let verification_state = verification_state(&InMemory, Service::default(), Default::default()).await;
+        let verification_state = Arc::new(verification_state(&InMemory, Service::default(), Default::default()).await);
 
         let mut app = router(verification_state);
 
diff --git a/agent_application/example.config.yaml b/agent_application/example.config.yaml
index d9622544..8b9baf88 100644
--- a/agent_application/example.config.yaml
+++ b/agent_application/example.config.yaml
@@ -47,25 +47,6 @@ display:
       uri: "https://www.impierce.com/external/impierce-icon.png"
       alt_text: UniCore Logo
 
-credential_configurations:
-  - credential_configuration_id: w3c_vc_credential
-    format: jwt_vc_json
-    credential_definition:
-      type:
-        - VerifiableCredential
-    display:
-      - name: Impierce Credential
-        locale: en
-        logo:
-          uri: https://www.impierce.com/external/impierce-logo.png
-          alt_text: UniCore Logo
-    authorization:
-      pre_authorized: true
-      transaction_code_constraints:
-        input_mode: "numeric"
-        length: 6
-        description: "Transaction code to authorize credential issuance"
-
 # File-based key management
 secret_manager:
   stronghold_path: "/tmp/local.stronghold.dat"
diff --git a/agent_application/src/main.rs b/agent_application/src/main.rs
index c69b7a9b..2e00fac9 100644
--- a/agent_application/src/main.rs
+++ b/agent_application/src/main.rs
@@ -12,7 +12,10 @@ use agent_authorization::services::AuthorizationServices;
 use agent_event_publisher_http::EventPublisherHttp;
 use agent_holder::services::HolderServices;
 use agent_identity::services::IdentityServices;
-use agent_issuance::services::IssuanceServices;
+use agent_issuance::{
+    application::policies::issuer_metadata_synchronization_policy::IssuerMetadataSynchronizationPolicy,
+    services::IssuanceServices,
+};
 use agent_secret_manager::{service::Service as _, subject::Subject};
 use agent_shared::config::{config, EventStoreType};
 use agent_store::{in_memory::InMemory, mongodb::MongoDB, postgres::Postgres, EventPublisher};
@@ -45,43 +48,119 @@ async fn main() -> io::Result<()> {
     let verification_event_publishers: Vec<Box<dyn EventPublisher>> =
         vec![Box::new(EventPublisherHttp::load().unwrap())];
 
+    // TODO: Refactor this to reduce code duplication.
     let (identity_state, library_state, authorization_state, issuance_state, holder_state, verification_state) =
         match config().event_store.type_ {
             EventStoreType::Postgres => {
                 let builder = Postgres::new().await;
+
+                let issuance_state =
+                    Arc::new(agent_store::issuance_state(&builder, issuance_services, issuance_event_publishers).await);
+
+                let issuer_metadata_synchronization_policy =
+                    IssuerMetadataSynchronizationPolicy::new(issuance_state.clone());
+
                 (
-                    agent_store::identity_state(&builder, identity_services, identity_event_publishers).await,
-                    agent_store::library_state(&builder, library_event_publishers).await,
-                    agent_store::authorization_state(&builder, authorization_services, authorization_event_publishers)
+                    Arc::new(agent_store::identity_state(&builder, identity_services, identity_event_publishers).await),
+                    Arc::new(
+                        agent_store::library_state(
+                            &builder,
+                            library_event_publishers,
+                            vec![Box::new(issuer_metadata_synchronization_policy)],
+                        )
                         .await,
-                    agent_store::issuance_state(&builder, issuance_services, issuance_event_publishers).await,
-                    agent_store::holder_state(&builder, holder_services, holder_event_publishers).await,
-                    agent_store::verification_state(&builder, verification_services, verification_event_publishers)
+                    ),
+                    Arc::new(
+                        agent_store::authorization_state(
+                            &builder,
+                            authorization_services,
+                            authorization_event_publishers,
+                        )
                         .await,
+                    ),
+                    issuance_state,
+                    Arc::new(agent_store::holder_state(&builder, holder_services, holder_event_publishers).await),
+                    Arc::new(
+                        agent_store::verification_state(&builder, verification_services, verification_event_publishers)
+                            .await,
+                    ),
                 )
             }
             EventStoreType::MongoDb => {
                 let builder = MongoDB::new().await;
+
+                let issuance_state =
+                    Arc::new(agent_store::issuance_state(&builder, issuance_services, issuance_event_publishers).await);
+
+                let issuer_metadata_synchronization_policy =
+                    IssuerMetadataSynchronizationPolicy::new(issuance_state.clone());
+
                 (
-                    agent_store::identity_state(&builder, identity_services, identity_event_publishers).await,
-                    agent_store::library_state(&builder, library_event_publishers).await,
-                    agent_store::authorization_state(&builder, authorization_services, authorization_event_publishers)
+                    Arc::new(agent_store::identity_state(&builder, identity_services, identity_event_publishers).await),
+                    Arc::new(
+                        agent_store::library_state(
+                            &builder,
+                            library_event_publishers,
+                            vec![Box::new(issuer_metadata_synchronization_policy)],
+                        )
+                        .await,
+                    ),
+                    Arc::new(
+                        agent_store::authorization_state(
+                            &builder,
+                            authorization_services,
+                            authorization_event_publishers,
+                        )
+                        .await,
+                    ),
+                    issuance_state,
+                    Arc::new(agent_store::holder_state(&builder, holder_services, holder_event_publishers).await),
+                    Arc::new(
+                        agent_store::verification_state(&builder, verification_services, verification_event_publishers)
+                            .await,
+                    ),
+                )
+            }
+            EventStoreType::InMemory => {
+                let issuance_state = Arc::new(
+                    agent_store::issuance_state(&InMemory, issuance_services, issuance_event_publishers).await,
+                );
+
+                let issuer_metadata_synchronization_policy =
+                    IssuerMetadataSynchronizationPolicy::new(issuance_state.clone());
+
+                (
+                    Arc::new(
+                        agent_store::identity_state(&InMemory, identity_services, identity_event_publishers).await,
+                    ),
+                    Arc::new(
+                        agent_store::library_state(
+                            &InMemory,
+                            library_event_publishers,
+                            vec![Box::new(issuer_metadata_synchronization_policy)],
+                        )
+                        .await,
+                    ),
+                    Arc::new(
+                        agent_store::authorization_state(
+                            &InMemory,
+                            authorization_services,
+                            authorization_event_publishers,
+                        )
                         .await,
-                    agent_store::issuance_state(&builder, issuance_services, issuance_event_publishers).await,
-                    agent_store::holder_state(&builder, holder_services, holder_event_publishers).await,
-                    agent_store::verification_state(&builder, verification_services, verification_event_publishers)
+                    ),
+                    issuance_state,
+                    Arc::new(agent_store::holder_state(&InMemory, holder_services, holder_event_publishers).await),
+                    Arc::new(
+                        agent_store::verification_state(
+                            &InMemory,
+                            verification_services,
+                            verification_event_publishers,
+                        )
                         .await,
+                    ),
                 )
             }
-            EventStoreType::InMemory => (
-                agent_store::identity_state(&InMemory, identity_services, identity_event_publishers).await,
-                agent_store::library_state(&InMemory, library_event_publishers).await,
-                agent_store::authorization_state(&InMemory, authorization_services, authorization_event_publishers)
-                    .await,
-                agent_store::issuance_state(&InMemory, issuance_services, issuance_event_publishers).await,
-                agent_store::holder_state(&InMemory, holder_services, holder_event_publishers).await,
-                agent_store::verification_state(&InMemory, verification_services, verification_event_publishers).await,
-            ),
         };
 
     info!("{:?}", config());
diff --git a/agent_holder/src/offer/aggregate.rs b/agent_holder/src/offer/aggregate.rs
index e00c33dd..318884b4 100644
--- a/agent_holder/src/offer/aggregate.rs
+++ b/agent_holder/src/offer/aggregate.rs
@@ -349,11 +349,12 @@ pub mod tests {
         config_mut().credential_endpoint = application_url.join("openid4vci/credential").unwrap();
         config_mut().credential_offer_uri = application_url.join("openid4vci/credential-offer/").unwrap();
 
-        let issuance_state = issuance_state(&InMemory, Service::default(), Default::default()).await;
+        let issuance_state = Arc::new(issuance_state(&InMemory, Service::default(), Default::default()).await);
         agent_issuance::state::initialize(&issuance_state).await.unwrap();
         let mut credential_isser = issuance::router(issuance_state.clone());
 
-        let authorization_state = authorization_state(&InMemory, Service::default(), Default::default()).await;
+        let authorization_state =
+            Arc::new(authorization_state(&InMemory, Service::default(), Default::default()).await);
         agent_authorization::state::initialize(&authorization_state)
             .await
             .unwrap();
diff --git a/agent_issuance/Cargo.toml b/agent_issuance/Cargo.toml
index da14ed57..6e6a25dd 100644
--- a/agent_issuance/Cargo.toml
+++ b/agent_issuance/Cargo.toml
@@ -5,6 +5,7 @@ edition.workspace = true
 rust-version.workspace = true
 
 [dependencies]
+agent_library = { path = "../agent_library" }
 agent_shared = { path = "../agent_shared" }
 agent_secret_manager = { path = "../agent_secret_manager" }
 
@@ -44,8 +45,10 @@ agent_secret_manager = { path = "../agent_secret_manager", features = [
     "test_utils",
 ] }
 agent_shared = { path = "../agent_shared", features = ["test_utils"] }
+agent_store = { path = "../agent_store" }
 async-std.workspace = true
 serial_test = "3.0"
+tokio.workspace = true
 tracing-test.workspace = true
 
 [features]
diff --git a/agent_issuance/src/application/mod.rs b/agent_issuance/src/application/mod.rs
index d4fbae16..899c8ad2 100644
--- a/agent_issuance/src/application/mod.rs
+++ b/agent_issuance/src/application/mod.rs
@@ -1 +1,2 @@
 pub mod access_token_validation_service;
+pub mod policies;
diff --git a/agent_issuance/src/application/policies/issuer_metadata_synchronization_policy.rs b/agent_issuance/src/application/policies/issuer_metadata_synchronization_policy.rs
new file mode 100644
index 00000000..139f11ea
--- /dev/null
+++ b/agent_issuance/src/application/policies/issuer_metadata_synchronization_policy.rs
@@ -0,0 +1,141 @@
+use crate::state::{IssuanceState, SERVER_CONFIG_ID};
+use agent_library::template::aggregate::Template;
+use agent_shared::handlers::command_handler;
+use async_trait::async_trait;
+use cqrs_es::{EventEnvelope, Query};
+use oid4vci::{
+    credential_format_profiles::{
+        w3c_verifiable_credentials::jwt_vc_json::{self, JwtVcJsonParameters},
+        CredentialFormats, Parameters,
+    },
+    credential_issuer::credential_configurations_supported::{CredentialConfigurationsSupportedDisplay, Logo},
+};
+use std::sync::Arc;
+
+pub struct IssuerMetadataSynchronizationPolicy {
+    issuance_state: Arc<IssuanceState>,
+}
+
+impl IssuerMetadataSynchronizationPolicy {
+    pub fn new(issuance_state: Arc<IssuanceState>) -> Self {
+        Self { issuance_state }
+    }
+}
+
+#[async_trait]
+impl Query<Template> for IssuerMetadataSynchronizationPolicy {
+    async fn dispatch(&self, _aggregate_id: &str, events: &[EventEnvelope<Template>]) {
+        use crate::server_config::command::ServerConfigCommand::*;
+        use agent_library::template::event::TemplateEvent::*;
+
+        for event in events {
+            match &event.payload {
+                TemplateCreated {
+                    template_id,
+                    title,
+                    display,
+                    authorization,
+                    ..
+                } => {
+                    let new_display = if let Some(display) = display {
+                        let old_logo = display.logo.as_ref().unwrap().clone();
+                        let logo = Logo {
+                            uri: old_logo.uri.parse().unwrap(),
+                            alt_text: old_logo.alt_text,
+                        };
+
+                        let new_display = CredentialConfigurationsSupportedDisplay {
+                            name: display.name.clone(),
+                            locale: None,
+                            logo: Some(logo),
+                            description: None,
+                            background_image: None,
+                            background_color: None,
+                            text_color: None,
+                        };
+
+                        Some(new_display)
+                    } else {
+                        None
+                    };
+
+                    let command = CreateCredentialConfiguration {
+                        template_id: template_id.clone(),
+                        credential_configuration_id: title.clone(),
+                        credential_format_with_parameters: CredentialFormats::JwtVcJson(Parameters {
+                            parameters: JwtVcJsonParameters {
+                                credential_definition: jwt_vc_json::CredentialDefinition {
+                                    type_: vec!["VerifiableCredential".to_string()],
+                                    credential_subject: Default::default(),
+                                },
+                            },
+                        }),
+                        display: if let Some(display) = new_display {
+                            vec![display]
+                        } else {
+                            vec![]
+                        },
+                        claims: vec![],
+                        authorization: authorization.clone(),
+                    };
+
+                    let _ =
+                        command_handler(SERVER_CONFIG_ID, &self.issuance_state.command.server_config, command).await;
+                }
+                TitleUpdated { template_id, title, .. } => {
+                    let command = UpdateCredentialConfigurationId {
+                        template_id: template_id.clone(),
+                        credential_configuration_id: title.clone(),
+                    };
+
+                    let _ =
+                        command_handler(SERVER_CONFIG_ID, &self.issuance_state.command.server_config, command).await;
+                }
+                DisplayUpdated {
+                    template_id, display, ..
+                } => {
+                    let logo = if let Some(logo) = &display.logo {
+                        Some(Logo {
+                            uri: logo.uri.parse().unwrap(),
+                            alt_text: logo.alt_text.clone(),
+                        })
+                    } else {
+                        None
+                    };
+
+                    let new_display = CredentialConfigurationsSupportedDisplay {
+                        name: display.name.clone(),
+                        locale: None,
+                        logo,
+                        description: None,
+                        background_image: None,
+                        background_color: None,
+                        text_color: None,
+                    };
+
+                    let command = UpdateCredentialConfigurationDisplay {
+                        template_id: template_id.clone(),
+                        display: new_display,
+                    };
+
+                    let _ =
+                        command_handler(SERVER_CONFIG_ID, &self.issuance_state.command.server_config, command).await;
+                }
+                AuthorizationUpdated {
+                    template_id,
+                    authorization,
+                    ..
+                } => {
+                    let command = UpdateCredentialConfigurationAuthorization {
+                        template_id: template_id.clone(),
+                        authorization: authorization.clone(),
+                    };
+
+                    let _ =
+                        command_handler(SERVER_CONFIG_ID, &self.issuance_state.command.server_config, command).await;
+                }
+                _ => {}
+            }
+        }
+    }
+}
diff --git a/agent_issuance/src/application/policies/mod.rs b/agent_issuance/src/application/policies/mod.rs
new file mode 100644
index 00000000..9db298b2
--- /dev/null
+++ b/agent_issuance/src/application/policies/mod.rs
@@ -0,0 +1 @@
+pub mod issuer_metadata_synchronization_policy;
diff --git a/agent_issuance/src/credential/application/token_status_list_service.rs b/agent_issuance/src/credential/application/token_status_list_service.rs
index 6066487b..2b782dbf 100644
--- a/agent_issuance/src/credential/application/token_status_list_service.rs
+++ b/agent_issuance/src/credential/application/token_status_list_service.rs
@@ -27,7 +27,7 @@ impl TokenStatusListService {
     pub async fn create_gzip_status_list_jwt_token(
         self,
         status_list_number: usize,
-        state: IssuanceState,
+        state: &IssuanceState,
     ) -> Result<Vec<u8>, TokenStatusListError> {
         let all_credentials = query_handler("all_credentials", &state.query.all_credentials)
             .await?
@@ -119,7 +119,7 @@ impl TokenStatusListService {
         let default_did_method = get_preferred_did_method().to_string();
 
         let jwt_token = encode(
-            state.subject,
+            state.subject.clone(),
             status_list_token.header,
             status_list_token.claims,
             &default_did_method,
diff --git a/agent_issuance/src/server_config/aggregate.rs b/agent_issuance/src/server_config/aggregate.rs
index 1441d788..ee74a92e 100644
--- a/agent_issuance/src/server_config/aggregate.rs
+++ b/agent_issuance/src/server_config/aggregate.rs
@@ -1,4 +1,4 @@
-use agent_shared::config::Authorization;
+use agent_library::template::event::Authorization;
 use async_trait::async_trait;
 use cqrs_es::Aggregate;
 use jsonwebtoken::Algorithm;
@@ -18,12 +18,12 @@ use crate::server_config::event::ServerConfigEvent;
 use crate::services::IssuanceServices;
 
 fn into_credential_configurations_supported(
-    credential_configurations: &HashMap<String, (bool, CredentialConfigurationsSupportedObject, Authorization)>,
+    credential_configurations: &HashMap<String, (String, CredentialConfigurationsSupportedObject, Authorization)>,
 ) -> HashMap<String, CredentialConfigurationsSupportedObject> {
     credential_configurations
         .iter()
         .map(
-            |(credential_configuration_id, (_provisioned, credential_configuration, _authorization_grant))| {
+            |(_template_id, (credential_configuration_id, credential_configuration, _authorization))| {
                 (credential_configuration_id.clone(), credential_configuration.clone())
             },
         )
@@ -55,7 +55,7 @@ fn into_proof_types_supported(signing_algorithms_supported: &[Algorithm]) -> Has
 pub struct ServerConfig {
     pub authorization_server_metadata: AuthorizationServerMetadata,
     pub credential_issuer_metadata: CredentialIssuerMetadata,
-    pub credential_configurations: HashMap<String, (bool, CredentialConfigurationsSupportedObject, Authorization)>,
+    pub credential_configurations: HashMap<String, (String, CredentialConfigurationsSupportedObject, Authorization)>,
     pub cryptographic_binding_methods_supported: Vec<String>,
     pub signing_algorithms_supported: Vec<Algorithm>,
 }
@@ -77,7 +77,6 @@ impl Aggregate for ServerConfig {
         _services: &Self::Services,
     ) -> Result<Vec<Self::Event>, Self::Error> {
         use ServerConfigCommand::*;
-        use ServerConfigError::*;
         use ServerConfigEvent::*;
 
         info!("Handling command: {:?}", command);
@@ -119,7 +118,7 @@ impl Aggregate for ServerConfig {
             } => {
                 let mut credential_configurations = self.credential_configurations.clone();
 
-                for (_credential_configuration_id, (_provisioned, credential_configuration, _authorization_grant)) in
+                for (_template_id, (_credential_configuration_id, credential_configuration, _authorization)) in
                     credential_configurations.iter_mut()
                 {
                     credential_configuration.cryptographic_binding_methods_supported =
@@ -141,7 +140,7 @@ impl Aggregate for ServerConfig {
             } => {
                 let mut credential_configurations = self.credential_configurations.clone();
 
-                for (_credential_configuration_id, (_provisioned, credential_configuration, _authorization_grant)) in
+                for (_template_id, (_credential_configuration_id, credential_configuration, _authorization)) in
                     credential_configurations.iter_mut()
                 {
                     credential_configuration.credential_signing_alg_values_supported =
@@ -160,42 +159,42 @@ impl Aggregate for ServerConfig {
                     credential_configurations,
                 }])
             }
-            UpdateCredentialConfiguration {
-                credential_configuration,
-                provisioned,
+
+            CreateCredentialConfiguration {
+                template_id,
+                credential_configuration_id,
+                credential_format_with_parameters,
+                display,
+                claims,
+                authorization,
             } => {
                 let proof_types_supported = into_proof_types_supported(&self.signing_algorithms_supported);
 
                 let credential_configuration_object = CredentialConfigurationsSupportedObject {
-                    credential_format: credential_configuration.credential_format_with_parameters,
+                    credential_format: credential_format_with_parameters,
                     cryptographic_binding_methods_supported: self.cryptographic_binding_methods_supported.clone(),
                     credential_signing_alg_values_supported: into_credential_signing_alg_values_supported(
                         &self.signing_algorithms_supported,
                     ),
                     proof_types_supported,
-                    display: credential_configuration.display,
-                    claims: credential_configuration.claims,
+                    display,
+                    claims,
                     ..Default::default()
                 };
 
                 let mut credential_configurations = self.credential_configurations.clone();
-                if let Some((existing_provisioned, existing_credential_configuration, existing_authorization_grant)) =
-                    credential_configurations.get_mut(&credential_configuration.credential_configuration_id)
+                if let Some((existing_credential_configuration_id, existing_credential_configuration, _authorization)) =
+                    credential_configurations.get_mut(&template_id)
                 {
-                    if !provisioned && *existing_provisioned {
-                        return Err(UpdateProvisionedCredentialConfigurationError);
-                    }
-
+                    *existing_credential_configuration_id = credential_configuration_id.clone();
                     *existing_credential_configuration = credential_configuration_object;
-                    *existing_provisioned = provisioned;
-                    *existing_authorization_grant = credential_configuration.authorization.clone();
                 } else {
                     credential_configurations.insert(
-                        credential_configuration.credential_configuration_id.clone(),
+                        template_id,
                         (
-                            provisioned,
+                            credential_configuration_id.clone(),
                             credential_configuration_object,
-                            credential_configuration.authorization.clone(),
+                            authorization,
                         ),
                     );
                 }
@@ -204,35 +203,79 @@ impl Aggregate for ServerConfig {
                 credential_issuer_metadata.credential_configurations_supported =
                     into_credential_configurations_supported(&credential_configurations);
 
-                Ok(vec![CredentialConfigurationUpdated {
-                    credential_configuration_id: credential_configuration.credential_configuration_id,
+                Ok(vec![CredentialConfigurationCreated {
+                    credential_configuration_id,
                     credential_issuer_metadata,
                     credential_configurations,
                 }])
             }
-            RemoveCredentialConfiguration {
+            UpdateCredentialConfigurationId {
+                template_id,
                 credential_configuration_id,
-                provisioned,
             } => {
                 let mut credential_configurations = self.credential_configurations.clone();
+                if let Some((
+                    existing_credential_configuration_id,
+                    _existing_credential_configuration,
+                    _authorization,
+                )) = credential_configurations.get_mut(&template_id)
+                {
+                    *existing_credential_configuration_id = credential_configuration_id;
+                }
 
-                let existing_provisioned = credential_configurations
-                    .get(&credential_configuration_id)
-                    .map(|(provisioned, _, _)| *provisioned)
-                    .unwrap_or(false);
+                let mut credential_issuer_metadata = Box::new(self.credential_issuer_metadata.clone());
+                credential_issuer_metadata.credential_configurations_supported =
+                    into_credential_configurations_supported(&credential_configurations);
 
-                if !provisioned && existing_provisioned {
-                    return Err(RemoveProvisionedCredentialConfigurationError);
-                } else {
-                    credential_configurations.remove(&credential_configuration_id);
+                Ok(vec![CredentialConfigurationIdUpdated {
+                    credential_issuer_metadata,
+                    credential_configurations,
+                }])
+            }
+            UpdateCredentialConfigurationDisplay { template_id, display } => {
+                let mut credential_configurations = self.credential_configurations.clone();
+                if let Some((_, existing_credential_configuration, _authorization)) =
+                    credential_configurations.get_mut(&template_id)
+                {
+                    existing_credential_configuration.display = vec![display];
+                }
+
+                let mut credential_issuer_metadata = Box::new(self.credential_issuer_metadata.clone());
+                credential_issuer_metadata.credential_configurations_supported =
+                    into_credential_configurations_supported(&credential_configurations);
+
+                Ok(vec![CredentialConfigurationDisplayUpdated {
+                    credential_issuer_metadata,
+                    credential_configurations,
+                }])
+            }
+            UpdateCredentialConfigurationAuthorization {
+                template_id,
+                authorization,
+            } => {
+                let mut credential_configurations = self.credential_configurations.clone();
+                if let Some((_, _, existing_authorization)) = credential_configurations.get_mut(&template_id) {
+                    *existing_authorization = authorization;
                 }
 
+                let mut credential_issuer_metadata = Box::new(self.credential_issuer_metadata.clone());
+                credential_issuer_metadata.credential_configurations_supported =
+                    into_credential_configurations_supported(&credential_configurations);
+
+                Ok(vec![CredentialConfigurationAuthorizationUpdated {
+                    credential_issuer_metadata,
+                    credential_configurations,
+                }])
+            }
+            RemoveCredentialConfiguration { template_id } => {
+                let mut credential_configurations = self.credential_configurations.clone();
+                credential_configurations.remove(&template_id);
+
                 let mut credential_issuer_metadata = Box::new(self.credential_issuer_metadata.clone());
                 credential_issuer_metadata.credential_configurations_supported =
                     into_credential_configurations_supported(&credential_configurations);
 
                 Ok(vec![CredentialConfigurationRemoved {
-                    credential_configuration_id,
                     credential_issuer_metadata,
                     credential_configurations,
                 }])
@@ -287,7 +330,8 @@ impl Aggregate for ServerConfig {
                 self.credential_issuer_metadata = *credential_issuer_metadata;
                 self.credential_configurations = credential_configurations;
             }
-            CredentialConfigurationUpdated {
+
+            CredentialConfigurationCreated {
                 credential_configuration_id: _,
                 credential_issuer_metadata,
                 credential_configurations,
@@ -295,8 +339,28 @@ impl Aggregate for ServerConfig {
                 self.credential_issuer_metadata = *credential_issuer_metadata;
                 self.credential_configurations = credential_configurations;
             }
+            CredentialConfigurationIdUpdated {
+                credential_issuer_metadata,
+                credential_configurations,
+            } => {
+                self.credential_issuer_metadata = *credential_issuer_metadata;
+                self.credential_configurations = credential_configurations;
+            }
+            CredentialConfigurationDisplayUpdated {
+                credential_issuer_metadata,
+                credential_configurations,
+            } => {
+                self.credential_issuer_metadata = *credential_issuer_metadata;
+                self.credential_configurations = credential_configurations;
+            }
+            CredentialConfigurationAuthorizationUpdated {
+                credential_issuer_metadata,
+                credential_configurations,
+            } => {
+                self.credential_issuer_metadata = *credential_issuer_metadata;
+                self.credential_configurations = credential_configurations;
+            }
             CredentialConfigurationRemoved {
-                credential_configuration_id: _,
                 credential_issuer_metadata,
                 credential_configurations,
             } => {
@@ -314,13 +378,7 @@ pub mod server_config_tests {
     use crate::server_config::aggregate::ServerConfig;
     use crate::server_config::event::ServerConfigEvent;
     use agent_secret_manager::service::Service;
-    use agent_shared::config::{Authorization, CredentialConfiguration};
     use cqrs_es::test::TestFramework;
-    use oid4vci::credential_format_profiles::w3c_verifiable_credentials::jwt_vc_json::JwtVcJson;
-    use oid4vci::credential_format_profiles::{w3c_verifiable_credentials, CredentialFormats, Parameters};
-    use oid4vci::credential_issuer::credential_configurations_supported::{
-        CredentialConfigurationsSupportedDisplay, Logo,
-    };
     use rstest::*;
 
     type ServerConfigTestFramework = TestFramework<ServerConfig>;
@@ -347,61 +405,6 @@ pub mod server_config_tests {
                 signing_algorithms_supported,
             }]);
     }
-
-    #[rstest]
-    fn test_add_credential_configuration(
-        authorization_server_metadata: Box<AuthorizationServerMetadata>,
-        credential_issuer_metadata: Box<CredentialIssuerMetadata>,
-        cryptographic_binding_methods_supported: Vec<String>,
-        signing_algorithms_supported: Vec<Algorithm>,
-        credential_configuration_id: String,
-        credential_configurations: HashMap<String, (bool, CredentialConfigurationsSupportedObject, Authorization)>,
-        credential_issuer_metadata_with_credential_configuration: Box<CredentialIssuerMetadata>,
-    ) {
-        ServerConfigTestFramework::with(Service::default())
-            .given(vec![ServerConfigEvent::ServerMetadataInitialized {
-                authorization_server_metadata,
-                credential_issuer_metadata,
-                cryptographic_binding_methods_supported,
-                signing_algorithms_supported,
-            }])
-            .when(ServerConfigCommand::UpdateCredentialConfiguration {
-                credential_configuration: CredentialConfiguration {
-                    credential_configuration_id: credential_configuration_id.clone(),
-                    credential_format_with_parameters: CredentialFormats::JwtVcJson(Parameters::<JwtVcJson> {
-                        parameters: w3c_verifiable_credentials::jwt_vc_json::JwtVcJsonParameters {
-                            credential_definition: w3c_verifiable_credentials::jwt_vc_json::CredentialDefinition {
-                                type_: vec!["VerifiableCredential".to_string()],
-                                credential_subject: Default::default(),
-                            },
-                        },
-                    }),
-                    display: vec![CredentialConfigurationsSupportedDisplay {
-                        name: "Verifiable Credential".to_string(),
-                        locale: Some("en".to_string()),
-                        logo: Some(Logo {
-                            uri: "https://www.impierce.com/external/impierce-logo.png".parse().unwrap(),
-                            alt_text: Some("Impierce Logo".to_string()),
-                        }),
-                        description: None,
-                        background_image: None,
-                        background_color: None,
-                        text_color: None,
-                    }],
-                    claims: vec![],
-                    authorization: Authorization {
-                        pre_authorized: true,
-                        tx_code_constraints: None,
-                    },
-                },
-                provisioned: false,
-            })
-            .then_expect_events(vec![ServerConfigEvent::CredentialConfigurationUpdated {
-                credential_configuration_id,
-                credential_issuer_metadata: credential_issuer_metadata_with_credential_configuration,
-                credential_configurations,
-            }]);
-    }
 }
 
 #[cfg(feature = "test_utils")]
diff --git a/agent_issuance/src/server_config/command.rs b/agent_issuance/src/server_config/command.rs
index a4f08b62..1e538ff6 100644
--- a/agent_issuance/src/server_config/command.rs
+++ b/agent_issuance/src/server_config/command.rs
@@ -1,7 +1,12 @@
-use agent_shared::config::CredentialConfiguration;
+use agent_library::template::event::Authorization;
 use jsonwebtoken::Algorithm;
-use oid4vci::credential_issuer::{
-    authorization_server_metadata::AuthorizationServerMetadata, credential_issuer_metadata::CredentialIssuerMetadata,
+use oid4vci::{
+    credential_format_profiles::{CredentialFormats, WithParameters},
+    credential_issuer::{
+        authorization_server_metadata::AuthorizationServerMetadata,
+        credential_configurations_supported::{ClaimDescription, CredentialConfigurationsSupportedDisplay},
+        credential_issuer_metadata::CredentialIssuerMetadata,
+    },
 };
 use serde::Deserialize;
 
@@ -27,12 +32,28 @@ pub enum ServerConfigCommand {
     UpdateSigningAlgorithms {
         signing_algorithms_supported: Vec<Algorithm>,
     },
-    UpdateCredentialConfiguration {
-        credential_configuration: CredentialConfiguration,
-        provisioned: bool,
+
+    CreateCredentialConfiguration {
+        template_id: String,
+        credential_configuration_id: String,
+        credential_format_with_parameters: CredentialFormats<WithParameters>,
+        display: Vec<CredentialConfigurationsSupportedDisplay>,
+        claims: Vec<ClaimDescription>,
+        authorization: Authorization,
     },
-    RemoveCredentialConfiguration {
+    UpdateCredentialConfigurationId {
+        template_id: String,
         credential_configuration_id: String,
-        provisioned: bool,
+    },
+    UpdateCredentialConfigurationDisplay {
+        template_id: String,
+        display: CredentialConfigurationsSupportedDisplay,
+    },
+    UpdateCredentialConfigurationAuthorization {
+        template_id: String,
+        authorization: Authorization,
+    },
+    RemoveCredentialConfiguration {
+        template_id: String,
     },
 }
diff --git a/agent_issuance/src/server_config/error.rs b/agent_issuance/src/server_config/error.rs
index d8f5a9e5..b143f0cc 100644
--- a/agent_issuance/src/server_config/error.rs
+++ b/agent_issuance/src/server_config/error.rs
@@ -1,9 +1,4 @@
 use thiserror::Error;
 
 #[derive(Error, Debug)]
-pub enum ServerConfigError {
-    #[error("Cannot update provisioned credential configuration during runtime")]
-    UpdateProvisionedCredentialConfigurationError,
-    #[error("Cannot remove provisioned credential configuration during runtime")]
-    RemoveProvisionedCredentialConfigurationError,
-}
+pub enum ServerConfigError {}
diff --git a/agent_issuance/src/server_config/event.rs b/agent_issuance/src/server_config/event.rs
index 8a80f9b5..f1dc18ac 100644
--- a/agent_issuance/src/server_config/event.rs
+++ b/agent_issuance/src/server_config/event.rs
@@ -1,4 +1,4 @@
-use agent_shared::config::Authorization;
+use agent_library::template::event::Authorization;
 use cqrs_es::DomainEvent;
 use jsonwebtoken::Algorithm;
 use oid4vci::credential_issuer::{
@@ -28,22 +28,34 @@ pub enum ServerConfigEvent {
     CryptographicBindingMethodsUpdated {
         cryptographic_binding_methods_supported: Vec<String>,
         credential_issuer_metadata: Box<CredentialIssuerMetadata>,
-        credential_configurations: HashMap<String, (bool, CredentialConfigurationsSupportedObject, Authorization)>,
+        credential_configurations: HashMap<String, (String, CredentialConfigurationsSupportedObject, Authorization)>,
     },
     SigningAlgorithmsUpdated {
         signing_algorithms_supported: Vec<Algorithm>,
         credential_issuer_metadata: Box<CredentialIssuerMetadata>,
-        credential_configurations: HashMap<String, (bool, CredentialConfigurationsSupportedObject, Authorization)>,
+        credential_configurations: HashMap<String, (String, CredentialConfigurationsSupportedObject, Authorization)>,
     },
-    CredentialConfigurationUpdated {
+
+    CredentialConfigurationCreated {
         credential_configuration_id: String,
         credential_issuer_metadata: Box<CredentialIssuerMetadata>,
-        credential_configurations: HashMap<String, (bool, CredentialConfigurationsSupportedObject, Authorization)>,
+        credential_configurations: HashMap<String, (String, CredentialConfigurationsSupportedObject, Authorization)>,
+    },
+    CredentialConfigurationIdUpdated {
+        credential_issuer_metadata: Box<CredentialIssuerMetadata>,
+        credential_configurations: HashMap<String, (String, CredentialConfigurationsSupportedObject, Authorization)>,
+    },
+    CredentialConfigurationDisplayUpdated {
+        credential_issuer_metadata: Box<CredentialIssuerMetadata>,
+        credential_configurations: HashMap<String, (String, CredentialConfigurationsSupportedObject, Authorization)>,
+    },
+    CredentialConfigurationAuthorizationUpdated {
+        credential_issuer_metadata: Box<CredentialIssuerMetadata>,
+        credential_configurations: HashMap<String, (String, CredentialConfigurationsSupportedObject, Authorization)>,
     },
     CredentialConfigurationRemoved {
-        credential_configuration_id: String,
         credential_issuer_metadata: Box<CredentialIssuerMetadata>,
-        credential_configurations: HashMap<String, (bool, CredentialConfigurationsSupportedObject, Authorization)>,
+        credential_configurations: HashMap<String, (String, CredentialConfigurationsSupportedObject, Authorization)>,
     },
 }
 
diff --git a/agent_issuance/src/server_config/views.rs b/agent_issuance/src/server_config/views.rs
index a2aefccf..49e411bf 100644
--- a/agent_issuance/src/server_config/views.rs
+++ b/agent_issuance/src/server_config/views.rs
@@ -54,7 +54,8 @@ impl View<ServerConfig> for ServerConfigView {
                 self.credential_issuer_metadata.clone_from(credential_issuer_metadata);
                 self.credential_configurations.clone_from(credential_configurations);
             }
-            CredentialConfigurationUpdated {
+
+            CredentialConfigurationCreated {
                 credential_configuration_id: _,
                 credential_issuer_metadata,
                 credential_configurations,
@@ -62,8 +63,28 @@ impl View<ServerConfig> for ServerConfigView {
                 self.credential_issuer_metadata.clone_from(credential_issuer_metadata);
                 self.credential_configurations.clone_from(credential_configurations);
             }
+            CredentialConfigurationIdUpdated {
+                credential_issuer_metadata,
+                credential_configurations,
+            } => {
+                self.credential_issuer_metadata.clone_from(credential_issuer_metadata);
+                self.credential_configurations.clone_from(credential_configurations);
+            }
+            CredentialConfigurationDisplayUpdated {
+                credential_issuer_metadata,
+                credential_configurations,
+            } => {
+                self.credential_issuer_metadata.clone_from(credential_issuer_metadata);
+                self.credential_configurations.clone_from(credential_configurations);
+            }
+            CredentialConfigurationAuthorizationUpdated {
+                credential_issuer_metadata,
+                credential_configurations,
+            } => {
+                self.credential_issuer_metadata.clone_from(credential_issuer_metadata);
+                self.credential_configurations.clone_from(credential_configurations);
+            }
             CredentialConfigurationRemoved {
-                credential_configuration_id: _,
                 credential_issuer_metadata,
                 credential_configurations,
             } => {
diff --git a/agent_issuance/src/state.rs b/agent_issuance/src/state.rs
index 11a0eb62..c2da618f 100644
--- a/agent_issuance/src/state.rs
+++ b/agent_issuance/src/state.rs
@@ -1,10 +1,7 @@
 use agent_secret_manager::subject::SubjectExt;
 use agent_shared::application_state::CommandHandler;
-use agent_shared::config::{
-    config, get_all_enabled_did_methods, get_all_enabled_signing_algorithms_supported, CredentialConfiguration,
-};
+use agent_shared::config::{config, get_all_enabled_did_methods, get_all_enabled_signing_algorithms_supported};
 use agent_shared::handlers::{command_handler, query_handler};
-use agent_shared::profile::ApplicationProfile;
 use agent_shared::UrlAppendHelpers;
 use cqrs_es::persist::ViewRepository;
 use oid4vci::credential_issuer::authorization_server_metadata::AuthorizationServerMetadata;
@@ -85,7 +82,6 @@ pub async fn initialize(state: &IssuanceState) -> anyhow::Result<()> {
     load_server_metadata(state).await?;
     update_cryptographic_binding_methods(state).await?;
     update_signing_algorithms(state).await?;
-    update_credential_configurations(state).await?;
 
     Ok(())
 }
@@ -195,109 +191,3 @@ pub async fn update_signing_algorithms(state: &IssuanceState) -> anyhow::Result<
 
     Ok(())
 }
-
-pub async fn update_credential_configurations(state: &IssuanceState) -> anyhow::Result<()> {
-    let provisioned_credential_configurations: Vec<CredentialConfiguration> = config()
-        .credential_configuration_file
-        .as_ref()
-        .map(|file| {
-            debug!("Path to credential configuration file: {}", file.as_path().display());
-
-            let file = std::fs::read(file.as_path()).expect("Failed to read credential configuration file");
-            serde_json::from_slice(&file).expect("Failed to parse credential configurations from file")
-        })
-        .unwrap_or_else(|| match ApplicationProfile::load() {
-            ApplicationProfile::Development => {
-                info!("Using default development credential configurations.");
-                serde_json::from_value::<Vec<CredentialConfiguration>>(serde_json::json!([
-                  {
-                    "credential_configuration_id": "001",
-                    "format": "jwt_vc_json",
-                    "credential_definition": {
-                      "type": ["VerifiableCredential"]
-                    },
-                    "display": [
-                      {
-                        "name": "Verifiable Credential",
-                        "locale": "en",
-                        "logo": {
-                          "uri": "https://www.impierce.com/external/impierce-logo.png",
-                          "alt_text": "Impierce Logo"
-                        }
-                      }
-                    ],
-                    "claims": [
-                        {
-                            "path": ["credentialSubject", "first_name"],
-                            "display": [{
-                                "name": "First Name",
-                                "locale": "en"
-                            }],
-                        },
-                        {
-                            "path": ["credentialSubject", "last_name"],
-                            "display": [{
-                                "name": "Last Name",
-                                "locale": "en"
-                            }],
-                        },
-                        {
-                            "path": ["credentialSubject", "dob"],
-                            "display": [{
-                                "name": "Date of Birth",
-                                "locale": "en"
-                            }],
-                        }
-                    ]
-                  }
-                ]))
-                .expect("Failed to parse default development credential configurations")
-            }
-            ApplicationProfile::Production => {
-                info!("No credential configurations found");
-                vec![]
-            }
-        });
-
-    let previous_provisioned_credential_configuration_ids = query_handler(SERVER_CONFIG_ID, &state.query.server_config)
-        .await?
-        .map(|server_config_view| {
-            server_config_view
-                .credential_configurations
-                .into_iter()
-                .filter_map(
-                    |(credential_configuration_id, (provisioned, _credential_configuration, _authorization))| {
-                        (provisioned
-                            && !provisioned_credential_configurations.iter().any(
-                                |provisioned_credential_configuration| {
-                                    *provisioned_credential_configuration.credential_configuration_id
-                                        == credential_configuration_id
-                                },
-                            ))
-                        .then_some(credential_configuration_id)
-                    },
-                )
-                .collect::<Vec<_>>()
-        })
-        .unwrap_or_default();
-
-    for credential_configuration_id in previous_provisioned_credential_configuration_ids {
-        let command = ServerConfigCommand::RemoveCredentialConfiguration {
-            credential_configuration_id,
-            provisioned: true,
-        };
-
-        command_handler(SERVER_CONFIG_ID, &state.command.server_config, command).await?;
-    }
-
-    for provisioned_credential_configuration in provisioned_credential_configurations {
-        let command = ServerConfigCommand::UpdateCredentialConfiguration {
-            credential_configuration: provisioned_credential_configuration,
-            provisioned: true,
-        };
-
-        command_handler(SERVER_CONFIG_ID, &state.command.server_config, command).await?;
-    }
-
-    Ok(())
-}
diff --git a/agent_library/Cargo.toml b/agent_library/Cargo.toml
index b4d9b686..625daa64 100644
--- a/agent_library/Cargo.toml
+++ b/agent_library/Cargo.toml
@@ -10,6 +10,8 @@ agent_shared = { path = "../agent_shared" }
 async-trait.workspace = true
 chrono.workspace = true
 cqrs-es.workspace = true
+# TODO: remove this when moving `Authorization` to `agent_issuance`.
+oid4vci = { git = "https://github.com/impierce/openid4vc", rev = "99fc7be" }
 serde.workspace = true
 serde_json.workspace = true
 serde_with.workspace = true
diff --git a/agent_library/src/template/aggregate.rs b/agent_library/src/template/aggregate.rs
index c9c49b55..fa39a438 100644
--- a/agent_library/src/template/aggregate.rs
+++ b/agent_library/src/template/aggregate.rs
@@ -1,5 +1,6 @@
 use async_trait::async_trait;
 use cqrs_es::Aggregate;
+use oid4vci::credential_offer::TxCodeConstraints;
 use serde::{Deserialize, Serialize};
 use serde_with::skip_serializing_none;
 use tracing::{debug, info};
@@ -40,6 +41,23 @@ pub enum HolderType {
     Organization,
 }
 
+// TODO: This should be moved to `agent_issuance`
+#[derive(Deserialize, Serialize, Debug, Clone, PartialEq)]
+pub struct Authorization {
+    pub pre_authorized: bool,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub tx_code_constraints: Option<TxCodeConstraints>,
+}
+
+impl Default for Authorization {
+    fn default() -> Self {
+        Self {
+            pre_authorized: true,
+            tx_code_constraints: None,
+        }
+    }
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize, Default, Eq, PartialEq)]
 #[serde(rename_all = "snake_case")]
 pub enum Status {
@@ -72,6 +90,7 @@ pub struct Template {
     pub status: Status,
     pub visibility: Visibility,
     pub description: Option<String>,
+    pub authorization: Authorization,
     pub r#type: Vec<String>,
     pub schema: Option<serde_json::Value>,
 }
@@ -109,6 +128,7 @@ impl Aggregate for Template {
                 status,
                 visibility,
                 description,
+                authorization,
                 r#type,
                 schema,
             } => {
@@ -129,6 +149,7 @@ impl Aggregate for Template {
                     status,
                     visibility,
                     description,
+                    authorization,
                     r#type,
                     schema,
                 }])
@@ -298,11 +319,12 @@ impl Aggregate for Template {
                 status,
                 visibility,
                 description,
+                authorization,
                 r#type,
                 schema,
             } => {
                 self.template_id = template_id;
-                self.title = title;
+                self.title.replace(title);
                 self.display = display;
                 self.credential_format = credential_format;
                 self.creator = creator;
@@ -312,6 +334,7 @@ impl Aggregate for Template {
                 self.status = status;
                 self.visibility = visibility;
                 self.description = description;
+                self.authorization = authorization;
                 self.r#type = r#type;
                 self.schema = schema;
             }
@@ -387,6 +410,14 @@ impl Aggregate for Template {
                 self.description = Some(description);
                 self.modified_at.replace(modified_at);
             }
+            AuthorizationUpdated {
+                template_id: _,
+                authorization,
+                modified_at,
+            } => {
+                self.authorization = authorization;
+                self.modified_at.replace(modified_at);
+            }
             TypeUpdated {
                 template_id: _,
                 r#type,
@@ -421,7 +452,7 @@ pub mod document_tests {
     #[serial_test::serial]
     async fn test_create_template(
         template_id: String,
-        title: Option<String>,
+        title: String,
         display: Option<Display>,
         credential_format: Option<CredentialFormat>,
         creator: Option<String>,
@@ -431,6 +462,7 @@ pub mod document_tests {
         status: Status,
         visibility: Visibility,
         description: Option<String>,
+        authorization: Authorization,
         r#type: Vec<String>,
         schema: Option<serde_json::Value>,
     ) {
@@ -447,6 +479,7 @@ pub mod document_tests {
                 status: status.clone(),
                 visibility: visibility.clone(),
                 description: description.clone(),
+                authorization: authorization.clone(),
                 r#type: r#type.clone(),
                 schema: schema.clone(),
             })
@@ -462,6 +495,7 @@ pub mod document_tests {
                 status,
                 visibility,
                 description,
+                authorization,
                 r#type,
                 schema,
             }])
@@ -479,8 +513,8 @@ pub mod test_utils {
     }
 
     #[fixture]
-    pub fn title() -> Option<String> {
-        Some("Sample Template".to_string())
+    pub fn title() -> String {
+        "Sample Template".to_string()
     }
 
     #[fixture]
@@ -531,6 +565,11 @@ pub mod test_utils {
         Some("Sample description".to_string())
     }
 
+    #[fixture]
+    pub fn authorization() -> Authorization {
+        Authorization::default()
+    }
+
     #[fixture]
     pub fn r#type() -> Vec<String> {
         vec!["Type1".to_string(), "Type2".to_string()]
diff --git a/agent_library/src/template/command.rs b/agent_library/src/template/command.rs
index f0a75e3a..6b9d3b76 100644
--- a/agent_library/src/template/command.rs
+++ b/agent_library/src/template/command.rs
@@ -1,3 +1,5 @@
+use crate::template::aggregate::Authorization;
+
 pub use super::aggregate::{CredentialFormat, Display, HolderType, Status, Visibility};
 use serde::Deserialize;
 
@@ -6,7 +8,7 @@ use serde::Deserialize;
 pub enum TemplateCommand {
     CreateTemplate {
         template_id: String,
-        title: Option<String>,
+        title: String,
         display: Option<Display>,
         credential_format: Option<CredentialFormat>,
         creator: Option<String>,
@@ -15,6 +17,7 @@ pub enum TemplateCommand {
         status: Status,
         visibility: Visibility,
         description: Option<String>,
+        authorization: Authorization,
         r#type: Vec<String>,
         schema: Option<serde_json::Value>,
     },
diff --git a/agent_library/src/template/event.rs b/agent_library/src/template/event.rs
index dce4706e..09f5e4ae 100644
--- a/agent_library/src/template/event.rs
+++ b/agent_library/src/template/event.rs
@@ -1,4 +1,4 @@
-pub use super::aggregate::{CredentialFormat, Display, HolderType, Status, Visibility};
+pub use super::aggregate::{Authorization, CredentialFormat, Display, HolderType, Status, Visibility};
 use cqrs_es::DomainEvent;
 use serde::{Deserialize, Serialize};
 use strum::Display;
@@ -8,7 +8,7 @@ use strum::Display;
 pub enum TemplateEvent {
     TemplateCreated {
         template_id: String,
-        title: Option<String>,
+        title: String,
         display: Option<Display>,
         credential_format: Option<CredentialFormat>,
         creator: Option<String>,
@@ -18,6 +18,7 @@ pub enum TemplateEvent {
         status: Status,
         visibility: Visibility,
         description: Option<String>,
+        authorization: Authorization,
         r#type: Vec<String>,
         schema: Option<serde_json::Value>,
     },
@@ -66,6 +67,11 @@ pub enum TemplateEvent {
         description: String,
         modified_at: String,
     },
+    AuthorizationUpdated {
+        template_id: String,
+        authorization: Authorization,
+        modified_at: String,
+    },
     TypeUpdated {
         template_id: String,
         r#type: Vec<String>,
diff --git a/agent_library/src/template/views/mod.rs b/agent_library/src/template/views/mod.rs
index b4e6228d..fad6ae0a 100644
--- a/agent_library/src/template/views/mod.rs
+++ b/agent_library/src/template/views/mod.rs
@@ -23,11 +23,12 @@ impl View<Template> for Template {
                 status,
                 visibility,
                 description,
+                authorization,
                 r#type,
                 schema,
             } => {
                 self.template_id.clone_from(template_id);
-                self.title.clone_from(title);
+                self.title.replace(title.clone());
                 self.display.clone_from(display);
                 self.credential_format.clone_from(credential_format);
                 self.creator.clone_from(creator);
@@ -37,6 +38,7 @@ impl View<Template> for Template {
                 self.status.clone_from(status);
                 self.visibility.clone_from(visibility);
                 self.description.clone_from(description);
+                self.authorization.clone_from(authorization);
                 self.r#type.clone_from(r#type);
                 self.schema.clone_from(schema);
             }
@@ -112,6 +114,14 @@ impl View<Template> for Template {
                 self.description.replace(description.clone());
                 self.modified_at.replace(modified_at.clone());
             }
+            AuthorizationUpdated {
+                template_id: _,
+                authorization,
+                modified_at,
+            } => {
+                self.authorization.clone_from(authorization);
+                self.modified_at.replace(modified_at.clone());
+            }
             TypeUpdated {
                 template_id: _,
                 r#type,
diff --git a/agent_shared/src/config/mod.rs b/agent_shared/src/config/mod.rs
index 5c2d0e6c..dd10563c 100644
--- a/agent_shared/src/config/mod.rs
+++ b/agent_shared/src/config/mod.rs
@@ -8,12 +8,6 @@ use identity_iota::{
 };
 use jsonwebtoken::Algorithm;
 use oid4vc_core::SubjectSyntaxType;
-use oid4vci::credential_issuer::credential_configurations_supported::ClaimDescription;
-use oid4vci::credential_issuer::credential_configurations_supported::CredentialConfigurationsSupportedDisplay;
-use oid4vci::{
-    credential_format_profiles::{CredentialFormats, WithParameters},
-    credential_offer::TxCodeConstraints,
-};
 use oid4vp::authorization_request::{DcSdJwtParameters, JwtVcJsonParameters, JwtVpJsonParameters, VpFormatsSupported};
 use once_cell::sync::Lazy;
 use rand::Rng;
@@ -22,7 +16,6 @@ use serde_json::json;
 use serde_with::{skip_serializing_none, SerializeDisplay};
 use std::{
     collections::HashMap,
-    path::PathBuf,
     sync::{RwLock, RwLockReadGuard},
 };
 use strum::VariantArray;
@@ -252,8 +245,6 @@ pub struct ApplicationConfiguration {
     pub credential_offer_by_value_enabled: bool,
     #[config(development_default = "SecretManagerConfig::development_default()")]
     pub secret_manager: SecretManagerConfig,
-    #[config(default)]
-    pub credential_configuration_file: Option<Box<PathBuf>>,
     #[config(default = "
         HashMap::from(
             [
@@ -510,35 +501,6 @@ pub fn default_issuer_es256_key_id() -> KeyId {
     KeyId::new(ES256_KEY_ID)
 }
 
-#[derive(Deserialize, Serialize, Debug, Clone)]
-pub struct CredentialConfiguration {
-    pub credential_configuration_id: String,
-    #[serde(flatten)]
-    pub credential_format_with_parameters: CredentialFormats<WithParameters>,
-    #[serde(default)]
-    pub display: Vec<CredentialConfigurationsSupportedDisplay>,
-    #[serde(default)]
-    pub claims: Vec<ClaimDescription>,
-    #[serde(default)]
-    pub authorization: Authorization,
-}
-
-#[derive(Deserialize, Serialize, Debug, Clone, PartialEq)]
-pub struct Authorization {
-    pub pre_authorized: bool,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub tx_code_constraints: Option<TxCodeConstraints>,
-}
-
-impl Default for Authorization {
-    fn default() -> Self {
-        Self {
-            pre_authorized: true,
-            tx_code_constraints: None,
-        }
-    }
-}
-
 #[skip_serializing_none]
 #[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
 pub struct Logo {
@@ -1383,9 +1345,6 @@ mod tests {
 
         // Some display information is set
         assert_eq!(config.display.len(), 1);
-
-        // The Credential Configuration file is set to `None`
-        assert!(config.credential_configuration_file.is_none());
     }
 
     #[test]
diff --git a/agent_shared/tests/test.config.yaml b/agent_shared/tests/test.config.yaml
index 5080d2e2..7dd2634c 100644
--- a/agent_shared/tests/test.config.yaml
+++ b/agent_shared/tests/test.config.yaml
@@ -50,8 +50,6 @@ display:
       uri: https://www.impierce.com/external/impierce-icon.png
       alt_text: Impierce Icon
 
-credential_configuration_file: "../agent_shared/tests/test_credential_configurations.json"
-
 secret_manager:
   stronghold_path: ../agent_secret_manager/tests/res/test.stronghold.dat
   # stronghold_password: <defined in .env.test>
diff --git a/agent_store/src/lib.rs b/agent_store/src/lib.rs
index 4a8ba7ae..494d7353 100644
--- a/agent_store/src/lib.rs
+++ b/agent_store/src/lib.rs
@@ -218,15 +218,20 @@ pub async fn identity_state<CCB: CqrsComponentBuilder>(
 pub async fn library_state<CCB: CqrsComponentBuilder>(
     builder: &CCB,
     event_publishers: Vec<Box<dyn EventPublisher>>,
+    template_policies: Vec<Box<dyn Query<Template>>>,
 ) -> LibraryState {
     // Partition the event_publishers into the different aggregates.
     let Partitions {
-        template_event_publishers,
+        template_event_publishers: mut queries,
         ..
     } = partition_event_publishers(event_publishers);
 
+    for policy in template_policies {
+        queries.push(policy);
+    }
+
     let (template_command_handler, template, all_templates) = builder
-        .commands_and_queries::<Template, Template, AllTemplatesView>((), template_event_publishers)
+        .commands_and_queries::<Template, Template, AllTemplatesView>((), queries)
         .await;
 
     LibraryState {
diff --git a/docs/problem-details/issuance.md b/docs/problem-details/issuance.md
index 4259c9d6..4897e807 100644
--- a/docs/problem-details/issuance.md
+++ b/docs/problem-details/issuance.md
@@ -195,19 +195,3 @@ when the HTTP request does not complete successfully.
 ### Resolution
 
 Check the target URL and ensure that it is reachable and correctly configured to receive the Credential Offer.
-
-## Update Provisioned Credential Configuration Error
-
-This error occurs when an attempt is made to update a provisioned credential configuration during runtime. Provisioned credential configurations are immutable after initial setup, and any update operation will result in this error. The API returns a `400 Bad Request` error.
-
-### Resolution
-
-Provisioned credential configurations cannot be updated after they are set up. If you need to change a configuration, you must update your server's configuration files and restart the service.
-
-## Remove Provisioned Credential Configuration Error
-
-This error is returned when there is an attempt to remove a provisioned credential configuration during runtime. Provisioned credential configurations cannot be removed after they have been set up. The API returns a `400 Bad Request` error.
-
-### Resolution
-
-Provisioned credential configurations cannot be removed at runtime. To remove a configuration, update your server's configuration files and restart the service.