# Assurance

The strength of a proof belongs to the act, not to the identity. Three levels, derived at the instant of the act and frozen on the receipt.

> There is no identity-level assurance column, and there must never be one: a level stored on an identity would describe a past moment as if it were the present one.

## Three levels

| Level | What it means |
| --- | --- |
| face | A living person was present, verified by face with liveness |
| face_voice | A living person was present and spoke, with speech correlated to the pulse read by the camera at the same instant |
| face_voice_doc | The above, plus a verified identity document on record |

## Where it comes from

- `process-biovital-transaction` derives it at the act — see [identity/recognise](/identity/recognise#the-authorisation-sink).
- `mandate-issue` reads it from the level frozen on the capture that proved the issuance, so a capture that included a verified document produces a `face_voice_doc` mandate — see [mandates/issue](/mandates/issue).
- It is never sent by the client. A client that sends it is ignored.

## Nothing is backfilled

> A receipt written before assurance existed reports that the strength was not recorded (code `not_recorded`) rather than inferring a level after the fact. That refusal to backfill is what makes the receipt evidence rather than a claim.

## What does not change

The receipt and the public verification format are unchanged by assurance: they read the same field and render the same catalogue. See [receipts/verify](/receipts/verify).

One line integrators need: voice proves a living person is present; voice never says who the person is.