Policy

Verification of a valid mandate or of strong possession. No new presence: the proof is the mandate, not the person.

Minimum steps: mandate verification, result. It is the level of the delegated act, which resolves on the spot.

Passkey, with consent: the short step-up, when the policy reuses a recent proof. Device attestation stays target architecture.

Minimum steps: context transparency, general consent, passkey, result.

A living person, now, and the same one as the reference the client gave. Native presence and match, with consent per step.

Steps: context transparency, general consent, biometric consent, live presence with match, result. It is the policy in production.

Level 2 plus civil identity through a plugged source: Serpro Datavalid, in accreditation; or a gold gov.br account plus Serpro.

Steps: those of level 2 plus the identity lookup. It is the level of onboarding, of grants and of signatures.

The person sees what they are authorizing: the context the client sent, in the clear only for them. The receipt gets the hash and the list of declared keys.

Versioned text, accepted with a timestamp; the hash of the text and the version go in the receipt.

Separate from the general one, before any capture. Without it, the result is not released.

Active challenge by a certified third-party component, and comparison with the client's reference, kept encrypted only while the act is open. Image and template are discarded; the result and the hash of the reference remain.

Positive, negative or inconclusive. Inconclusive is never terminal: it comes out of human review, and deciding requires presence proven on the spot by the person deciding.

The review follows a versioned protocol, served by the same server that applies it, with a closed justification vocabulary that cannot contradict the verdict. The third verdict, "insufficient", returns the act for a new attempt instead of concluding it.

Plugged source, labelled in the receipt. Serpro Datavalid in accreditation; the response is minimized, the raw data never leaves.

Possession of the device over WebAuthn, with user verification on it; nothing biometric reaches Hummand. Registered only after an approved presence.

gov.br over OIDC; device attestation. Adapters with mock and real contract, no screen yet.

The scope of the mandate, shown and consented: actions, limits, validity, revocable. It is a step of the agent mandate and of the person mandate.

The document by hash, sent at creation; the presence of the person receiving the mandate, as a second presence, when the client asks for it. Available since 0.28.0, in the person mandate.

The mandate verification of the delegated act, which resolves immediately.

ICP-Brasil, gov.br or the receipt as an advanced signature.

The dashboard and the API read the effective policy: per type, the level, the steps, the deadline, the label and whether it is executable today, with the missing steps when it is not.

The Administrator turns types on or off, raises the minimum level and shortens the deadline; every edit is a new version, and the receipt carries the one that applied.

Conditions only over declared context keys, of primitive types: above a value, raise the level or require the enrolment photo. The rule never goes below the level of the type.

Hummand never reads the content of the context; it only compares values the client marked as comparable.

A window of up to 15 minutes: with a recent positive proof from the same person and an active passkey of theirs, the act is born at level 1 and asks only for the passkey. It applies to the transaction step-up and the operator's; recurring presence never reuses.

Without the passkey at hand, the person goes back to live presence in the same act and is never left without a way out.

Attempts in the same act (up to 3) and the detour when they run out, to negative or human review.

Per-client exception-proof escalation stays target architecture, like the type.