The document rule

Liveness is of the moment and is never reused. A document is a verified fact with its own validity, asked for once per identity and never again while it is valid.

The distinction

• Liveness is always of the moment. It is never stored and never reused. Face and voice are captured fresh for every operation. This does not change and cannot be configured away.
• A document is a verified fact with its own validity. What it proves does not expire every minute — it expires on the document's own date. Nobody should re-scan a passport at every purchase.

So: the person redoes face and voice every time, and the document holds until it expires.

The rule

Once per identity, not per operation. The account is born with face and voice. The document is asked for at the first operation that requires it — the first payment or the first money-scope mandate issuance, whichever comes first, possibly at the same moment the identity is created if the person arrives paying. After that it is never asked for again while it is valid.

The refusal

403 from process-biovital-transaction and from mandate-issue on a money scope:

{
  "success": false,
  "code": "DOCUMENT_REQUIRED",
  "required_assurance_level": "face_voice_doc",
  "current_assurance_level": "face_voice",
  "document_status": "missing",
  "document_valid_until": null,
  "liveness_reusable": false,
  "rule": "once_per_identity"
}

What the client does

Open the document step, then repeat the operation. With a valid record on file the operation passes silently — no extra step, no extra call.

Expiry

When the stored document passes its own validity date the state reads expired, and the next operation that requires a document asks again. Nothing else changes; face and voice were never affected.

Policy

The client decides the amount from which it requires a document, and can only be more strict than the engine's floor, never less. The floor is 100000 minor units. It is a floor, not a suggestion.