Identity continuity: proving it is still the same human

Almost every identity system in the world verifies a person once, at a boundary, and then assumes the answer holds. Employment, account ownership, professional licensure and platform access are not moments though. They are durations. Everything expensive happens in the gap between the check and the act.

Why does verifying someone once stop working?

Consider what a background check actually tells you. It tells you that on a particular Tuesday in March, a person presenting a particular set of documents had a particular history. It is a photograph. It is accurate about that Tuesday and it says nothing whatsoever about the following Thursday, or about the next fourteen months of employment, or about who is sitting at the keyboard on any given morning.

Every organisation knows this in the abstract and almost none of them design for it. The reason is structural rather than careless. Verification is expensive, so you do it as rarely as possible. It is also unpleasant, so you do it where the person is already expecting friction, which is the boundary: onboarding, account opening, first login, enrolment. Having paid that cost once, the system records a result and treats it as durable.

The trouble is that almost nothing we actually care about is a moment. We care about who is doing the work over a year. We care about who holds the account over a decade. We care about who has access to the production database between the day they were hired and the day they left, and for an uncomfortable number of organisations, for some time after that. The verification is a point and the risk is a line, and the industry has spent thirty years building better and better points.

We call this Identity Discontinuity, and it is one of fourteen named structural failures in the Identity Failure Map. It has two close relatives that appear throughout this pillar. The Enrollment Binding Gap is the failure to connect the human who was verified to the key or credential that will act later, so the verification and the acting are two unlinked events. Recovery Debt is the accumulated weakness of the paths a system offers when someone loses their credential, which is where every strong authenticator quietly reintroduces the problem it was meant to solve.

The gap has a shape, and you can see it

Lay out any identity relationship as a timeline and the gap becomes obvious. A remote hire is verified during onboarding, given a laptop and credentials, and then works for two years. Between the verification and the resignation there are perhaps five hundred working days, several thousand logins, and exactly zero further checks that the person doing the work is the person who was hired. The organisation has a document on file and a great deal of hope.

This is not a hypothetical risk. The Department of Justice and the Department of the Treasury have brought a series of prosecutions and sanctions actions concerning North Korean information technology workers who obtained employment at United States companies using stolen or fabricated identities, with intermediaries in the United States operating laptop farms so the work appeared to originate domestically. The scheme works precisely because the person who interviewed and the person at the keyboard are different, and nothing in a normal employment lifecycle ever asks the question again. We covered the mechanics of that operation in the laptop farm playbook.

The same shape appears everywhere once you look for it. A driver passes a background check and then rents the account to someone who did not, which we examine in who is actually driving. A contractor is vetted and then quietly replaced, covered in the rotating contractor. A nurse holds a genuine licence obtained on fraudulent prerequisites, which is the licence is not the person. A candidate sits an examination that someone else actually takes, which is proxy test takers. Different industries, different vocabulary, one missing primitive.

What is actually missing?

The missing capability is narrow and specific: a cheap, repeatable, privacy-preserving way to answer the question is this the same human as before, which is a genuinely different question from who is this human.

That distinction is the whole pillar, so it is worth slowing down. Identification asks the system to name you: to connect the person in front of it to a record in the world, usually via a document issued by a state. Continuity asks something much weaker and much more useful: it asks whether the person in front of it now is the same person who was in front of it before. Continuity does not need a name. It does not need a date of birth. It does not need to know anything about you at all beyond the fact that you are the one who was here last time.

Because continuity asks for less, it can be checked far more often, far more cheaply, and with far less data at rest. That is the entire argument. A system that can only identify people will identify them rarely, because identification is expensive and invasive. A system that can establish continuity can do it at every consequential moment, because sameness is cheap.

The analogy, and then the mechanism

Think about how a small village handles this. Nobody in a village checks documents. They do not need to, because they have continuity: they know the person who runs the bakery is the same person who ran it yesterday, not because they verified her passport but because they have an unbroken chain of recognition. The chain does the work. When someone new arrives, the village does something expensive and one-off, which is to establish who this person is, and thereafter it runs on continuity again.

Cities broke that, and documents are what we invented to replace it. But documents are a terrible substitute, because they compress a continuous relationship into a token that can be stolen, copied, forged or bought. The interesting technical question of the last decade is whether we can rebuild the village property, cheap unbroken recognition, without rebuilding the village surveillance property, everybody watching everybody.

You can, and the mechanism is less exotic than it sounds. At the moment of first verification, the person enrols a key on a device they hold. During enrolment, a face match is computed on the device and reduced to a one way key: a value derived from the biometric that cannot be reversed back into a face, and which is never uploaded. What leaves the device is a public key and a signature. What stays on the device is everything sensitive. There is no template in a server anywhere, which means there is no biometric database to breach, subpoena, sell or repurpose.

Later, at a moment that matters, the person is asked to re-establish sameness. The device performs a fresh liveness challenge and a fresh on device match against the same one way key, and if it succeeds it signs a small object with the enrolled key. That signed object is a continuity receipt. Here is what one actually contains.

{
  "type": "continuity.assert",
  "subject_key": "ed25519:9f4c...a1",   // the key enrolled at verification
  "anchor": "verify:2026-03-04",        // which verification event this chains to
  "checked": ["device_key", "liveness", "on_device_match"],
  "context": "shift_start:site_14",     // what this assertion is for
  "issued_at": "2026-10-02T06:58:11Z",
  "expires_at": "2026-10-02T07:08:11Z",
  "sig": "3045...c7"                    // signed by subject_key
}

Note what is not in that object. No image. No biometric template. No location history. No name. A verifier checking this receipt learns exactly one thing: the human who enrolled on the fourth of March asserted their presence at 06:58 this morning for the purpose of starting a shift, on the device they enrolled. It verifies offline against a published key, so the employer, an auditor or a future employer can check it without calling anyone and without a database lookup.

The receipt is small and boring on purpose. Boring is the security property.

The map: where continuity fails, and what covers it

This is the area in one table. Each row is a place where a system verifies once and assumes thereafter, the failure that produces, and the lesson that covers it in depth.

How does the employment lifecycle lose track of a person?

Hiring is the clearest case because the lifecycle is long, well documented, and made entirely of separate identity events that never speak to each other.

Walk it through. A candidate applies, and the application is a name and a claim. They interview, usually over video, and the interviewer forms an impression of a face and a voice. They accept an offer, which is signed electronically against an email address. They complete right to work paperwork, where documents are examined, increasingly over a video call. They receive a laptop, activate an account, enrol in payroll and receive a badge. Each of these steps verifies something. No two of them verify the same thing, and none of them is linked to the others by anything stronger than a name string and an employee number.

So when the person who interviewed and the person who works are different, there is no step in the process designed to notice. The interviewer might remember a face, but they are not present on day forty. The payroll system knows a bank account. The access system knows a username. We laid the full lifecycle out step by step in the person you interviewed is not always the person at the keyboard, and the striking thing is how reasonable each individual step looks in isolation.

The document examination step is now the softest part

There is a particular irony in the right to work step. It is the one moment in the entire lifecycle explicitly designed to verify identity documents, and it has become the weakest link rather than the strongest, because it is the one place the process accepts a fresh claim of identity rather than a proof of continuity.

The reason is a technical shift that most compliance teams have not yet absorbed. There is a large difference between a presentation attack, where someone holds a forged document or a photograph up to a real camera, and an injection attack, where synthetic frames are fed directly into the capture pipeline through a virtual camera driver or a modified application. Liveness detection was built for the first and struggles badly with the second, because every signal it checks is present, having been generated by the attacker. Yoti has published figures describing injection attacks against its client base in the millions annually, and Group-IB documented thousands of biometric injection attempts against a single financial institution over an eight month period. Both are vendor telemetry and count only what was caught, which makes them floors rather than measurements. We go through the mechanics in the camera is no longer evidence and the compliance specifics in remote I-9 verification.

The correct response is not to abandon document verification. It is to recognise that the durable artifact should not be the video. It should be the key that gets enrolled at that moment, because a key on a device can be re-checked cheaply forever, and a video cannot be re-checked at all.

The candidate carries risk too, and nobody verifies the employer

Hiring is an asymmetric trust relationship where one party is required to prove everything and the other proves nothing. The entire verification industry points in one direction. Meanwhile the Federal Bureau of Investigation's Internet Crime Complaint Center recorded employment fraud as a tracked crime type in its 2025 Internet Crime Report, with roughly 24,688 complaints and close to 363 million dollars in reported losses, and reporting rates for this category are widely believed to be suppressed by embarrassment. That is the candidate side of the same missing primitive, and it is covered in the company was real, the recruiter was not.

Can you prove presence without watching people?

Shift work is where continuity meets its most legitimate opposition, and the opposition deserves a proper hearing rather than a rebuttal.

The problem is old. One worker clocks in for another, usually as a favour rather than a scheme, and at scale it becomes a real payroll loss. The industry's answer has been biometric time clocks, and the industry's answer created a second problem, because fingerprint and hand geometry readers sit squarely inside biometric privacy statutes. The Illinois Biometric Information Privacy Act in particular has generated substantial class litigation against employers over exactly these devices. An employer solving a payroll integrity problem by collecting fingerprints has traded a known cost for an unbounded legal one. We work through the arithmetic, and the case law, in clocking in for a friend.

Home care is the same problem with higher stakes and a federal mandate attached. The 21st Century Cures Act required states to implement electronic visit verification for Medicaid personal care and home health services, precisely because of long standing concerns about billing for visits that did not happen. What the deployed systems actually verify is that a phone call originated from a location or that an application checked in at a set of coordinates. That binds a device to a place. It does not bind a carer to a patient, which is why documented cases involve verification calls for visits that never occurred. The full treatment, including the disability rights objections to surveillance in people's homes, is in the visit was billed, nobody came.

Presence is a receipt, not a feed

The design that resolves this is to replace a continuous feed with a discrete attestation. Instead of a camera running for a shift, or a fingerprint stored in a vendor database, the worker produces a signed presence receipt at the start of the shift and possibly at one or two other moments. The receipt proves this enrolled human was present at this time for this shift. It contains no image, no template, no location trail and no productivity judgment.

The second order benefit is the one that gets union agreement, and it is worth stating plainly because it inverts the usual framing. The receipts belong to the worker. In a wage dispute, a worker holding signed proof of the shifts they worked is in a stronger position than one relying on an employer's system. A control introduced to protect the employer from time fraud also protects the honest worker from an employer's record keeping. That is not a rhetorical flourish; it is a design requirement, and any deployment that keeps the receipts only on the employer's side has implemented the wrong thing.

What happens when the workforce is four companies deep?

Enterprises rarely employ the people who hold their credentials. An organisation contracts with a managed service provider, which subcontracts to a regional partner, which staffs from an agency, which engages individuals who may themselves be contracting through another entity. Due diligence was performed on the first link. Credentials are held at the far end.

This structure is not negligence. It is how specialised skills are sourced globally and it is economically rational at every step. But the security consequence is that identity is re-asserted rather than verified at each boundary, so assurance degrades multiplicatively down the chain while contractual protection applies only to the first link. Third party involvement is repeatedly identified as a leading factor in breach reporting, though the precise share moves considerably between report editions because the definition of a third party incident keeps changing. We take the chain apart in four companies deep, and the narrower problem of individuals rotating within a single supplier in you contracted with a firm.

Continuity is the natural answer here because it travels with the individual rather than with the contract. If the human at the far end of the chain holds an enrolled key, the enterprise can verify that the person using its credential today is the person who was approved, regardless of how many entities sit in between and regardless of whether the intermediate parties cooperate on anything else.

The same primitive, pointed at the individual rather than the engagement, is what makes work history portable. A freelancer with fifteen years of engagements has nothing they can carry to a new client, which we examine in fifteen years of work and every new client starts from zero. Continuity plus receipts turns a working life into evidence the worker owns.

What is the line between continuity and surveillance?

This section exists because the objection is correct in general and the distinction is genuinely narrow. Anyone who has watched employers deploy monitoring software is right to be suspicious of a company arriving with a new way to check on workers, and the burden of proof sits with the person proposing the check.

So here is the line, stated as precisely as we can make it.

Continuous behavioural inference observes how a person types, moves a pointer, holds a phone and navigates a system, builds a statistical profile, and compares live behaviour against it. To work at all it must collect continuously, store the profile, and keep comparing. The subject usually cannot see the profile, correct it, or delete it. When it is wrong it locks someone out with no legible reason, because the model cannot articulate one.

Discrete continuity attestation asks the person to perform a deliberate act at a small number of moments, produces a signed object, and stores nothing about them in between. There is no profile. There is nothing to be wrong about, because the check either verifies against the enrolled key or it does not, and a failure has a legible cause.

The difference is not a matter of degree. They are opposite designs that happen to answer superficially similar questions. One infers identity from ambient observation; the other proves it from a deliberate act. Only the second can carry intent, because intent requires a decision, and you cannot infer a decision from typing cadence. That argument, and the legal exposure that follows from the two approaches, is the whole of behavioural biometrics is surveillance with better branding.

The practical test for any workforce deployment

Four questions settle most cases, and they are worth putting to any vendor including this one.

• What is retained between checks? If the answer is a profile, a template, a video, or a stream of events, it is monitoring. If the answer is a public key and a set of signed receipts, it is not.
• How often does it run? Continuously is monitoring. At enumerated moments the worker can predict is not.
• Who holds the output? If only the employer holds it, it is a surveillance record. If the worker holds a copy they can use elsewhere, it is a credential.
• What does a failure mean? If a failure produces a risk score, the system is judging the person. If it produces a plain yes or no with a stated reason, it is checking a fact.

The knowledge work case deserves special mention because it is where monitoring is most common and least effective. Activity tracking measures presence at a device, which is not work. It penalises thinking, which looks like idleness, and rewards fidgeting. An employer with a genuine dual employment concern is better served by a handful of verifiable attestations than by eight hours of keystroke telemetry, and we make that argument at length, uncomfortably for both sides, in mouse jigglers, dual employment, and the surveillance trap.

Why is recovery the same problem wearing a different hat?

Here is the observation that ties the consumer half of this pillar to the workforce half: recovery is continuity with the sign flipped.

When someone loses their phone, the service faces exactly the question this pillar has been circling. Is the person contacting us the same person who set up this account? The service usually cannot answer it, so it falls back to the strongest external anchor it can buy, which is a government document plus a selfie. That is why losing a phone means uploading a passport.

The fallback is expensive, and it is now the softest part of the account lifecycle for the reason described earlier: it is the one place the service accepts a fresh claim of identity rather than a proof of sameness, which puts it directly in the path of injection attacks. Strengthening the login while leaving this path open moves the attacker rather than stopping them. Passkeys are a genuine improvement to authentication and they have made recovery the dominant residual risk, which is the argument of passkeys fixed the login. The consumer facing version, including what to set up before you lose the device, is why does losing your phone mean uploading your passport.

Continuity evidence beats re-proofing

Once you see recovery as a continuity question, better options appear. A second enrolled device. A co-signature from a prior key. A companion liveness check against the one way key established at enrolment. A designated trusted contact who signs. Time itself, since an attacker rarely waits. None of these require a document, and all of them are cheaper and more resistant than a fresh proofing event.

The adjacent failure is enrolment of new authenticators, which most systems treat as a routine settings change protected by the current session. That is backwards: enrolling an authenticator converts temporary possession of a session into durable independent access that survives password resets. It is the single most consequential action in most accounts and it is usually the least protected, which is the takeover button is labelled add authenticator.

Where does continuity run out?

Three cases sit at the edges of this area, and they are the ones that expose the limits of the whole approach.

Dormancy

Security models assume an owner who notices. Dormant accounts break that assumption completely, and they are attractive precisely because they are quiet. An old email account that is still the recovery address for newer accounts is not just an account, it is a key to everything downstream. Because the takeover generates no complaint and no support ticket, the category is systematically under counted in every statistic that drives security budgets. Reactivation, not login, is the moment that needs continuity evidence, and that is the safest account to steal.

Death

Continuity assumes the person is available to establish it. Death is the case where they are permanently not, and the systems handle it badly: an executor holding a court order faces dozens of services with different processes, several of which were designed for a living account holder and some of which will only delete. There is also a newer problem, which is that a deceased person's likeness and voice are cheap to synthesise and their family is a natural target. The design implication is that authority must be delegable forward, during life, as a signed and revocable instruction. We treat this carefully, because readers often arrive at it while grieving, in nobody plans for the identity that outlives its owner.

Displacement

Disaster relief and refugee response require identity verification precisely when documents have been destroyed, left behind, or were never issued. Continuity from a prior enrolment helps enormously if a prior enrolment exists, and does nothing if it does not. The honest position is that uniqueness rather than identity is usually what the programme actually needs, which lets an agency prevent duplicate claims while never learning who someone is, and that any design must degrade to a staffed human path treated as normal rather than exceptional. That is the flood took the documents.

Shared credentials and stale attributes

Two more edges are worth naming. Shared accounts are ubiquitous in clinical settings, retail, small business banking and on call rotations, and no amount of continuity helps if the credential itself belongs to five people. The answer there is to decouple convenience of access from accountability for effect, gating the consequential action rather than the login, which is the audit log says admin. And every attribute a system holds about a person is an observation with a timestamp rather than a fact, decaying at wildly different rates, which is the subject of every identity record is a photograph of a moving thing.

What does identity continuity not solve?

Every honest pillar needs this section, and the limits here are real.

It does not establish who someone is. Continuity chains to an anchor, and if the anchor was wrong then continuity faithfully preserves the error. A person who obtained employment with fraudulent documents and enrolled a key at that moment will produce perfect continuity receipts for years. Continuity makes identity durable; it does not make it correct. The correctness problem belongs to the initial proofing event and to the issuers behind it, which is why a genuine licence obtained on forged prerequisites is not a problem any amount of re-checking will find.

It does not survive coercion. Someone standing next to a worker can make them sign. Continuity proves the enrolled human was present and consented in a mechanical sense; it cannot see the second person in the room. This matters most in exactly the settings where people are most vulnerable, and no cryptographic control addresses it.

It does not detect a willing participant. If a person chooses to hand over their device and their attention for a payment, a shift or an examination, they have produced a valid proof of a real thing. The dishonest arrangement is invisible.

It does not measure quality, effort or intent. A presence receipt says a human was there. It does not say they did good work, and any employer hoping to buy an intensity metric should be told plainly that no identity technology provides one.

It requires enrolment, which excludes people. A design that assumes a modern smartphone excludes exactly the populations that public systems most affect. A staffed human fallback is not an exception path, it is a normal path, and any deployment that treats it as an edge case will fail the people it most needs to serve.

It does not fix the hiring market's information problems. Continuity says the same person is present throughout. It says nothing about whether their claimed experience is real, which is a provenance question covered in resume fraud in the AI era, nor about the interview process itself, which is the deepfake hiring playbook.

Where do the published standards sit?

Continuity is not a standard and should not pretend to be one. It composes with several bodies of work that are genuinely good at what they cover.

NIST Special Publication 800-63 is the reference for identity proofing and authentication assurance in the United States, and its separation of identity assurance from authentication assurance is exactly the right conceptual split. What the framework addresses least is the duration between events, since assurance levels describe the strength of a proofing or authentication act rather than the decay of that act over time.

ISO/IEC 30107 covers presentation attack detection and is the standard behind most liveness claims. It is well constructed for the attack class it names, and the injection attacks described above sit largely outside that class, which is a scoping observation rather than a criticism of the standard.

W3C Verifiable Credentials and related work provide the format for issuer signed claims that a holder can present, and are the natural carrier for the receipts described here. Manav has filed drafts on receipts and delegation chains with the IETF and the OpenID Foundation; those are filed rather than ratified, and should be read as proposals.

Biometric privacy law is not a standard but constrains this area more than any standard does. The Illinois Biometric Information Privacy Act and the General Data Protection Regulation's treatment of biometric data processed for unique identification both make holding templates expensive. A design that stores only a one way key derived on device is not merely a privacy preference; it is the difference between a manageable compliance position and an unbounded one.

Reading paths

If you run HR or talent

Start with the person you interviewed for the lifecycle view, then remote I-9 verification for the compliance step, then fake employers so you understand the candidate's exposure, then the laptop farm playbook for what the mature version of this threat looks like.

If you own workforce security

Read the rotating contractor and contractor chains back to back, then they left in March for the departure side, then shared account attribution, and finish with identity decay to set your re-verification intervals by risk rather than by calendar.

If you build consumer identity

Begin with passkey recovery, then recovery without the ID upload for the design options, then the takeover button to fix the enrolment path, then dormant accounts and posthumous identity for the long tail nobody plans for.

If you sit on the privacy side, or on a works council

Read behavioural biometrics is surveillance with better branding first, because it draws the line this pillar depends on and argues partly against our own interest. Then the surveillance trap, then buddy punching for the biometric privacy case history, then phantom visits for the sharpest version of the dignity objection.

Frequently asked questions

What is identity continuity? Identity continuity is proof that the human acting now is the same human who was verified earlier. It is a weaker and more useful claim than identification, because it does not require knowing who the person is, only that they are the one who was here before. That makes it cheap enough to check repeatedly rather than once.

How is continuity different from just re-running identity verification? Re-verification establishes identity from scratch, usually from documents, at full cost and full friction, and it puts the account back in front of the attack that targets proofing pipelines. Continuity chains to a prior enrolment using a key the person already holds, so it costs seconds, collects no new documents, and does not reopen the proofing surface.

Does this mean storing employees' faces? No. The face match runs on the device and produces a one way key that cannot be reversed into an image. No template leaves the device and none is held on a server. That is the difference between a manageable position under biometric privacy law and an unbounded one, and it is a design constraint rather than a preference.

Is this monitoring by another name? No, and the test is what is retained between checks. Monitoring keeps a profile and compares continuously. Continuity keeps a public key and a set of signed receipts, runs at moments the worker can predict, produces a legible yes or no, and gives the worker a copy they can use elsewhere. If a system fails those tests it is monitoring, whoever sells it.

What happens when someone loses their phone? That is a recovery event, and recovery is continuity in reverse. The graduated options are a second enrolled device, a co-signature from a prior key, a companion liveness check against the enrolment key, or a designated trusted contact. A staffed fallback must always exist, because a user with one device and no prior receipts will otherwise be locked out permanently.

Can continuity catch a fraudulent hire? Only partially, and it is important to be exact. It catches substitution, meaning the case where the person hired and the person working differ, because that breaks the chain. It does not catch a person who was fraudulent from the beginning and enrolled honestly at onboarding, because continuity preserves whatever the anchor established, including an error.

How often should continuity be checked? As rarely as the risk allows. The right frequency is driven by what an undetected substitution would cost, not by a calendar. A handful of checks across an employment relationship is usually sufficient, and anything approaching continuous checking has stopped being continuity and become monitoring.

Does this work for people without smartphones? Not on its own, which is a genuine limit rather than a footnote. Any deployment in a public service, a benefits programme or a low wage workforce must include a staffed path treated as a normal route. A design that reaches only people with recent devices excludes the populations that these systems most affect.

Sources

1. Federal Bureau of Investigation, Internet Crime Complaint Center, annual Internet Crime Report series, for employment fraud complaint and loss figures: ic3.gov
2. United States Department of Justice, prosecutions and announcements concerning North Korean information technology worker schemes: justice.gov
3. United States Department of the Treasury, sanctions actions relating to the same schemes: home.treasury.gov
4. United States Citizenship and Immigration Services, I-9 Central, including the alternative procedure for remote document examination: uscis.gov/i-9-central
5. Centers for Medicare and Medicaid Services, electronic visit verification requirements under the 21st Century Cures Act: medicaid.gov
6. National Institute of Standards and Technology, Special Publication 800-63 Digital Identity Guidelines: pages.nist.gov/800-63-3
7. International Organization for Standardization, ISO/IEC 30107 on biometric presentation attack detection: iso.org
8. Yoti, published research on injection attacks against identity verification, reported as vendor telemetry: yoti.com/blog
9. Group-IB, research on biometric injection attempts against financial institutions: group-ib.com/resources
10. Illinois General Assembly, Biometric Information Privacy Act, 740 ILCS 14: ilga.gov
11. World Wide Web Consortium, Verifiable Credentials Data Model: w3.org/TR/vc-data-model-2.0

Verification is a photograph. Everything you actually care about is a film, and nobody has been checking the frames in between.