# Controlled integration UAT - draft

No production endpoint is supplied. Agree acceptance criteria with the project owner.

- Bind tenant, purpose and device to the authenticated client.
- Test missing/expired/replayed capture sessions and device revocation.
- Test match, no-match, ambiguity, poor capture, timeout and safe retry.
- Test idempotency and webhook duplicate/out-of-order handling.
- Verify identity decisions do not automatically authorize clinical or financial actions.
- Exercise non-biometric and assisted alternatives.
- Inspect data retention in memory, logs, caches, backups and exports.
- Verify evidence access, integrity mechanism and key trust separately.
- Measure performance under an agreed device, engine, dataset and network profile.
- Sign off privacy, security, usability, rollback and operational ownership.