Who is the person at this touchpoint?

Returning-patient check-in at a kiosk.

Resolve a person within an authorized population, organization and purpose.

Identity is bound to an authoritative source within an organization. Search population and access rights must be configured in advance.

From request to decision

Checks are bound to the same session.

Do not use one threshold indiscriminately across devices and contexts.

Component	Evaluation requirement	Evidence
PAD	Attack scope and evaluated configuration	Device / algorithm evaluation report
Performance	Threshold, test population, gallery, environment	Versioned evaluation profile
Device	Fresh session, certificate and revocation state	Device and configuration records
Authority & purpose	Processing basis and resource authorization	Policy version

Move from a workflow to technology, integration and evidence.