manav.id
You vetted Alex Torres — senior platform engineer, cleared background check, signed NDA. 30% of 2025 breaches involved a third party. The agency swapped Alex for an unvetted junior three weeks in; you never knew. Manav binds every work session to Alex's passkey. The substitute can't produce it. Access denied before they see a single line of production code.
Client (Acme)
contracted Alex
Contractor Portal
session start
Manav Gate
identity-bound
● pending
Work Systems
prod codebase · infra
Substitute
unvetted · no passkey
Alex Torres
vetted contractor
Alex's Phone
Face ID · registered
Manav Issuer
session receipt
⛔ Substitute blocked — no registered passkey
The substitute tries to start a work session using Alex's credentials. The Manav gate demands a fresh passkey proof bound to Alex's registered device. The substitute cannot produce it — no session, no codebase access.
POST /api/sessions/start HTTP/1.1 Authorization: Bearer contractor-alex-torres-creds // X-Manav-Proof: missing HTTP 428 Precondition Required {"error":"manav_proof_required","bound_to":"alex-torres"} // Substitute has no registered device for this contractor ID
✓ Alex verified — session open, receipt issued
Alex's passkey signed the session start. The client's audit log names the authorized individual, not just the agency. Every hour of work is traceable to a specific verified human.
contractor_id: "alex-torres" · verified: true · session_receipt: issued
Bind every contractor session to a named human
Add a manav.verify(contractor_id) call at session start in your contractor portal. Swaps are caught before the first commit. Demo key mnav_test_demo.