Identity and BYOI
Your directory stays the source of truth. Baselivery maps credentials to those principals, and lets a third party verify employment without ever seeing personal data.
We do not want to be your identity provider.
Becoming the directory would mean owning a migration nobody asked for. Baselivery consumes directory state instead.
Directory connectors already synchronise users, groups, and memberships. Enrollment keys off the identity your directory already assigned, so a principal in Baselivery is the same principal your identity platform disables on their last day.
That single detail is what makes revocation trustworthy. There is no second directory to fall out of step, no nightly reconciliation job that might have failed quietly, and no local account that outlives the real one.
What Baselivery adds is the binding between that principal and the physical world: which credential is in their wallet, which laptop serial is in their bag, and which zones they may stand in at this hour under this threat class.
- Card technology
- Modern contactless smart cards, or resident security keys
- Key custody
- Your own secure access module, on your own site
- Registration
- Diversified card identifier plus a keyed signature
- Custom domain
- Your subdomain, verified by DNS challenge
- Claim format
- Signed tokens with a published verification key set
- Signature
- Elliptic-curve, with rotating published keys
- Revocation
- Attestation status flips on the same kill path
- Personal data
- None returned. Ever
Issuing a credential without handing over your keys.
Local issuance, central session authority. The two are deliberately separable.
Print and encode on your own equipment
Your card printer and your secure access module encode the credential. The diversification keys stay on your premises and are never transmitted to us.
Register the identifier, not the key
The diversified card identifier is registered against a principal using a signature keyed to your tenant provisioning secret. We learn that a card exists and who holds it. We do not learn how to make another one.
The edge learns it on the next snapshot
The registration lands in the access list snapshot that portals verify and cache, so the credential works at the door without a central lookup on every tap.
Retirement is the same path as revocation
A lost card increments the device epoch. The identifier drops out of every site access list, and any attestation citing that principal reports a revoked status.
What a bank actually gets to see.
Employment verification usually means emailing a letter on letterhead. It discloses far more than the question required, and it cannot be withdrawn once sent.
| The question | Answer returned | What is withheld |
|---|---|---|
| Is this person currently employed here | A signed yes or no | Start date, role, salary, department |
| What is the employer's legal name | The registered legal entity name | Internal group structure, cost centre |
| Which tenant is asserting this | The verified tenant domain | Any other tenant's existence |
| Anything else | Refused | Photograph, email, phone, address, biometric templates |
A letter on letterhead is true forever, which is the problem. An attestation is true for as long as the employment is, and a landlord or bank re-checking next quarter gets the current answer rather than last year's.
Practical details.
Your own domain
Point a subdomain at the attestation host and prove control with a DNS record.
Published keys
The verification key set is public, so relying parties need no shared secret.
Directory is authoritative
Disabling an account in your identity platform is what ends access.
Existing cards
Where the technology supports secure diversification, existing estates can often be registered rather than reissued.
Contractors
Same enrollment path, with attributes that policy can treat differently by threat class.
Audit
Every attestation issued is logged with the relying party and the claims requested.
Related
Bring the door onto the same epoch as the laptop.
We will walk you through a live portal, a compiled policy pack, and a revocation that closes the turnstile and locks the screen while you watch.