Let citizens recognize the service asking for their trust.
A public agency must know who is using its service. A citizen should also have a way to verify the interaction before sharing access or approving a sensitive request.
People may use a public-service portal only a few times a year. A familiar seal or an urgent message can look convincing even when the destination is unfamiliar. Employees and contractors face similar questions at everyday access points.
With the app-based FDA approach, the enrolled app verifies the authentication server associated with the connected service. The person checks the request presented across the two screens. Verification has a role for the agency and for its user.
Put confirmation before a sensitive account change.
Consider a citizen service changing the contact details used to manage account access. The application can be configured to hold that change and request NoPass™ confirmation from the account holder’s device before proceeding.
The agency retains its identity-proofing, authorization and service rules; the approval checkpoint supplies a person’s decision within that workflow.
The application sends a NoPass approval request to the person responsible. Start the request in the application.
● ● ●Your public service
Example application request
Update account contact details
NoPass
Enrolled deviceReady when you are.
The request reaches your phone.
Open the push notification on the enrolled phone. The application waits while you check the request.
● ● ●Your public service
Example application request
Update account contact details
Waiting for your decision
NoPass
Approval requested
Update account contact details
Check both screens. Then decide.
Compare the black picture and number. If this is the request you intended, select Confirm on the phone, using the local confirmation configured for your device, such as fingerprint or Face ID.
● ● ●Your public service
Example application request
Update account contact details
Compare this picture and number with your phone.
501
Waiting for your decision
NoPass
Do you approve this account change?
501
Approved — back to application policy.
Approval received. The application still applies its own permissions and execution policy before carrying out the operation.
● ● ●Your public service
Example application request
Update account contact details
Approved
NoPass
Confirmed
Your approval has been sent.
Try the highlighted button or use the controls below.
A recognizable request and a clear choice help people understand what the service is asking them to do. The same principle can guide workforce access for agency employees and contractors.
Discuss a citizen or workforce interaction with the team, including the access and assisted-support needs of its users.
Account authentication and identity proofing are different tasks.
The public service owns citizen enrollment, eligibility and identity-proofing requirements. FDA authenticates the enrolled relationship; it does not establish a legal identity or confer a NIST assurance level.
Account authentication and identity proofing are different tasks.
Journey
Agency responsibility
Citizen account change
Validate the requested change, identify its owner and apply the result once under agency policy.
Staff access
Configure the workforce integration, permissions and device support.
Recovery and accessibility
Provide an approved assisted path when the enrolled device is unavailable.
Connect a customer account, an employee access point or a sensitive-operation checkpoint. Keep the application’s business logic and bring Identité® authentication to the interaction that needs it.
