Presence Sessions
Authorization is not a badge hit, and it is not a twelve-hour token. It is a Presence Session: principal, zone, device, modality, threat class, and clock, held jointly by the turnstile and the laptop.
One session governs the door and the laptop.
The turnstile, the endpoint agent, and the token issuer all resolve against the same session object. There is no second system to keep in step, and no reconciliation window in which the two planes disagree.
A Presence Session is the unit of authorization. Its validity is a function of the principal, the zone, the device, the set of satisfied modalities, the current threat class, and the clock. Every enforcement point in the estate reads that one object rather than keeping its own idea of who is trusted.
Because the door and the desktop share it, they cannot drift apart. Ending a session drops the credential from every site access list, closes the desktop unlock path, and invalidates outstanding workspace tokens, through a single monotonic epoch rather than three separate cleanups that each have to succeed.
This is what a ticket-driven process cannot reach. A service desk records that somebody has left. It does not close the turnstile and lock the screen in the same half-second, because it was never in the decision path.
- Principal
- Directory identity, not a card number
- Zone
- Portal, room, or spatial zone in the location tree
- Device
- Serial and hostname from the asset register
- Modality
- Which factors actually corroborated
- Composite score
- Weighted fusion of the satisfied modalities
- Threat class
- Green, amber, or red at decision time
- Epochs
- Principal and device fencing tokens
- Policy revision
- Hash of the pack that made the decision
How a session comes into existence.
The strike never waits on a neural network. Corroboration attaches to a session that is already open, and escalates the next door, the desktop, or the security team rather than attempting a physically impossible retract.
The card makes a claim
An encrypted credential arrives over a secure channel. The edge node checks its local access list and the principal's epoch. This is the only step permitted to block the strike, and it is budgeted at 80 milliseconds.
The session opens
A Presence Session is created and bound to a single tracked body in the portal polygon. If the body count and the claim count disagree, the session is held instead of admitted.
Corroboration attaches
Face geometry compares against the templates of the claimed principal alone, typically inside 400 milliseconds. Gait closes over roughly two strides. Both feed one composite score. Neither can unlock anything by itself.
The rest of the building inherits it
The session is what the next door, the jump host, and the laptop consult. A tailgated entry marks the session contaminated, and the next enforcement point challenges rather than trusting it.
Every portal decision is a named state.
There is no ambiguous middle. Each state defines what the strike does, whether inference is still running, and what the audit trail records.
IDLENo claim present. Approach tracking only, with nothing embedded.
CLAIMEDValid credential, access list hit. Corroboration begins.
CORROBORATINGWaiting on the scoring window. Asynchronous portals have already decided.
ADMITTEDComposite score cleared the admit threshold. Embeddings wiped.
ADMIT_WATCHLow score, admitted anyway, security team notified.
CHALLENGEStep-up required. Interlocked portals hold; others admit and flag.
TAILGATE_HOLDMore bodies than claims. The barrier de-energizes where it can.
WATCHLIST_HOLDPresentation-attack signal or list hit. Hard hold.
DEGRADEDA camera or accelerator is down. The policy decides what remains permitted.
DENIEDNo access list entry, stale epoch, or a failed score on an interlock.
REVOKEDThe epoch moved. The credential is dropped and the gallery row cleared.
The operating envelope.
What each enforcement point holds to, and where the time goes. Commercial commitments and their remedies are set on your order form.
| Objective | Target | Notes |
|---|---|---|
| Card presented to strike released | p99 under 80 ms | Asynchronous portal, card path only |
| Face score attached | p99 under 400 ms | Corroboration, not admission |
| Gait score attached | p99 under 1.8 s | About two strides of walking |
| On-site revocation to strike denial | p99 under 500 ms | From the moment the session authority commits |
| On-site revocation to desktop lock | p99 under 500 ms | Same epoch as the badge |
| Threat class fan-out | p99 under 1.0 s | Next credential presented re-evaluates |
| Edge node availability | 99.9% per site | Watchdog fails secure on the remainder |
| False hold rate | under 0.5% | Healthy enrolled principal, green threat, asynchronous portal |
Every session carries the principal and device epochs that authorised it. Moving either epoch invalidates that session everywhere it is held, so corroborating somebody at a door never hardens into standing trust that outlives their access.
What this deliberately is not.
Not a card system
A failed credential is terminal. Biometrics never open anything on their own.
Not a long-lived token
Existing token expiry is an upper bound, never evidence of validity.
Not city-scale recognition
Comparison is against the claimed principal's own templates.
Not cloud video
Frames stay on the edge node. There is no video product to buy.
Not an identity provider
Your directory remains the source of truth for who exists.
Not off-site presence
A laptop away from the estate has no physical signal and cannot satisfy a rule requiring one.
Related
Bring the door onto the same epoch as the laptop.
We will walk you through a live portal, a compiled policy pack, and a revocation that closes the turnstile and locks the screen while you watch.