Add a person-bound factor to your existing IAM through OIDC or SAML. You do not replace your identity provider to remove passwords — you add a person-bound factor where it matters most, starting with privileged access, and expand on your own schedule. Phone sign-in runs the live face check on the enrolled phone. Administrator photo provisioning processes the image transiently in the minting service; licensed on-premises webcam capture runs inside the customer deployment.
Recovery binds a replacement device after verified-mailbox PIN and new device-key checks; the original enrolled face is still required at sign-in. If the mailbox or enrollment reference is unavailable, the supported administrator recovery process applies.
KYA lets a verified human authorize an agent certificate with a defined model identity, scope and expiry.