Trusted Palm ID / identity servicesBind the same person,
Bind the same person,
not just two references.
Control source identity, enrollment session and palm capture together. This is a reference workflow, not an issued backend contract.
Every transition has a gate.
- 01Purpose
- 02Source identity
- 03Session & continuity
- 04Capture palm
- 05Quality / PAD
- 06Protect reference
- 07Duplicate review
- 08Binding & evidence
State model and evidence.
Proposed model identifiers; reconcile with the deployment contract.
| From | To | Condition | Reference |
|---|---|---|---|
PENDING_PROOFING | PROOFED | Source verification succeeds within the authorized scope | proofingRef |
PROOFED | CAPTURE_PENDING | Fresh session; same participant; permitted device | sessionRef + operatorRef |
CAPTURE_PENDING | QUALITY_ACCEPTED | Quality and PAD meet the configured profile | captureRef + profileRef |
QUALITY_ACCEPTED | BINDING_REVIEW | Protected reference; scoped duplicate review | biometricRef + reviewRef |
BINDING_REVIEW | ACTIVE | Binding requirements, purpose and processing authority remain valid | bindingRef + evidenceRef |
ANY_PENDING | EXPIRED | Expired session; do not reuse the old capture | reason + sessionRef |
ANY_PENDING | REJECTED | Participant mismatch, refusal or untrusted device | reason + reviewRef |
QUALITY_ACCEPTED | DUPLICATE_REVIEW | Possible duplicate; do not auto-merge records | scopedCandidates + reviewer |
ACTIVE | SUSPENDED | Suspend on request or risk | reason + authority |
SUSPENDED | REENROLL_REQUIRED | Re-proofing and fresh capture required | newSessionRef |
ACTIVE | REVOKED | Revoke binding; deletion is a separate lifecycle action | revocationRef |
Test exceptions before activation.
A local rule illustration; no biometric input and no RAR/C06 call.
Simulation resultACTIVE
All illustrative conditions pass.
No real binding is created.Continuity & recovery controls.
| Risk | Required behavior |
|---|---|
| A verifies, B presents a palm | Stop binding; re-establish participant identity and record the reason. |
| Expired session or interrupted network | Do not reuse the old capture. Start a fresh session and re-check conditions. |
| Possible duplicate | Remain within tenant/purpose; send to an authorized reviewer, never auto-merge. |
| Person declines | Stop biometric capture and offer an appropriate alternative. |
Start with a controlled PoC.
Define purpose, devices, risks and acceptance criteria before scaling.