# The document rule

Liveness is of the moment and is never reused. A document is a verified fact with its own validity, asked for once per identity and never again while it is valid.

## The distinction

- **Liveness** is always of the moment. It is never stored and never reused. Face and voice are captured fresh for every operation. This does not change and cannot be configured away.
- **A document** is a verified fact with its own validity. What it proves does not expire every minute — it expires on the document's own date. Nobody should re-scan a passport at every purchase.

So: the person redoes face and voice every time, and the document holds until it expires.

## The rule

Once per identity, not per operation. The account is born with face and voice. The document is asked for at the **first** operation that requires it — the first payment or the first money-scope mandate issuance, whichever comes first, possibly at the same moment the identity is created if the person arrives paying. After that it is never asked for again while it is valid.

| Asks for a document | Never asks |
| --- | --- |
| payment, purchase, signature | login, access, id_proof, task, data_share |

## The refusal

`403` from `process-biovital-transaction` and from `mandate-issue` on a money scope:

```
{
  "success": false,
  "code": "DOCUMENT_REQUIRED",
  "required_assurance_level": "face_voice_doc",
  "current_assurance_level": "face_voice",
  "document_status": "missing",
  "document_valid_until": null,
  "liveness_reusable": false,
  "rule": "once_per_identity"
}
```

> `liveness_reusable: false` is not decoration. The retry needs a fresh capture; the document step does not extend the liveness window.

## What the client does

Open the document step, then repeat the operation. With a valid record on file the operation passes silently — no extra step, no extra call.

## Expiry

When the stored document passes its own validity date the state reads `expired`, and the next operation that requires a document asks again. Nothing else changes; face and voice were never affected.

## Policy

The client decides the amount from which it requires a document, and can only be **more** strict than the engine's floor, never less. The floor is `100000` minor units. It is a floor, not a suggestion.