Individual sign-in on shared workstations

Nobody plans a shared login. It appears because per-user sign-in costs seconds that a floor measured in seconds will not spend, and once one exists it propagates: written down, passed along at handover, kept alive through years of staff turnover.

The cost lands later, and always during an incident. Once a credential is shared, every entry in the record points at a login rather than at a human being, and nothing downstream restores the name.

The workstation is never issued anything to protect. It has no enrollment, holds no key, and performs no face check. It draws a sign-in page carrying a code and keeps a connection open until something tells it whose session to start.

Trust is anchored instead in hardware with exactly one owner, the worker's own enrolled phone. Scanning, the liveness test, the one-to-one comparison and the signature all take place there. Only once that sequence completes is the terminal released into a session, and the session carries a name.

Some floors do not permit personal phones, and some sites cannot issue a device to every worker. There is an enterprise webcam method for exactly that situation, and its scope should be stated plainly rather than discovered during a pilot: it is available to enterprise customers on a trusted customer network, not as a self-serve option, because part of the assurance comes from the managed workstation and the network it sits on. This licensed on-premises method processes captures inside the customer deployment and does not add an enrolled-phone possession factor.

Capture in that method happens at the workstation camera rather than on a phone the worker carries, which is a materially different posture from the mobile ceremony and is priced, scoped and deployed accordingly. If that is the shape of your floor, contact sales@seventhsense.ai and the conversation starts with the network and the workstation build.

The point of all this is that the log finally names people. It is worth being exact about what that log is, because audit language gets stretched in this market and a security reviewer will notice.

Two records exist here, and they are not the same kind of record. Every authentication appends to a person-level stream that is read only and exports as CSV: the worker, the moment, and the device that answered. The hash-chained, tamper-evident log is the console one, and it covers configuration changes made by administrators. There is no customer-side verification of that chain, so the honest answer to an auditor is that we run it, not that you can check it yourself.

One assumption carries the whole design, and it is the first thing to test rather than the last: during the shift, every worker has to hold a device capable of running the companion app, or the site has to qualify for the enterprise webcam method.

Where that holds, the handover ends up quicker than typing a password ever was, and accountability stops being the thing traded away to buy the speed. Where it does not, the device question has to be settled first, because no amount of configuration substitutes for a trust anchor that is not there.