Offline-first principles
- Validity of a right is checked locally; expired rights are not accepted by the control point.
- A fully isolated point uses the last received revocation list. Until it is updated, a new revocation is not applied at that point.
- Consistent global anti-passback requires an Edge Hub or an exchange channel between control points; an isolated point can only enforce local sequence control.
- An offline right is always bounded by the validity set at issuance.
WAN recovery
Event delivery
Offline events are transferred to the core without duplicates, preserving their original timestamps.
Policy update
The control point receives current policies and revocation lists.
Decision preserved
The locally taken decision remains in the audit trail, marked as taken offline.
Synchronisation mark
The synchronisation time is recorded, making the offline window measurable.
Revoking a right and a trusted device
Revocation applies both to the right and to the subject's trusted device. Revoking a device stops presentation from that device without changing the right; revoking the right invalidates every associated means of presentation.
Propagation speed depends on connectivity: with a link or an Edge Hub the revocation applies promptly, while a fully isolated point applies it at the next revocation-list update.
Evidential audit
- Grounds, approvals, the issued right and its constraints are recorded.
- All control point decisions are recorded, including denials and manual decisions with their reasons.
- Online and offline decisions are distinguished; both event time and synchronisation time are kept.
- The journal is intended for incident review and for demonstrating that procedures were followed.
Related pages
- IDMATIC MOBILE and IDMATIC EdgeThe IDMATIC MOBILE mobile control point and IDMATIC Edge autonomous execution: verifying rights beyond fixed infrastructure, secure QR containers, event buffering and synchronisation.
- Right lifecycleThe full lifecycle of a physical right in IDMATIC NET: grounds, approval, right, execution, presence, change, revocation, completion and evidential audit.
- Integrations and ecosystemIDMATIC NET integrations: REST API, OpenAPI, webhooks, events and batch exchange, master data ownership, and interaction with XVMATIC, XViewsion and NEUROHUB.