1. Device enrollment
The employee and device are bound to the organization with a platform-backed credential.
Technical flow
Eight verifiable steps from device to decision.
MesaiGo does not consider “the phone saw the gateway” sufficient. Every attempt concludes in the context of the relevant device, gateway, entry point, time, assurance, and policy.
8Bound evidence steps
2Assurance profiles
1Server authority
0Silent downgrades
Evidence chain
Every step is bound to the next.
Disconnected signals are not combined merely because they were observed at the same time. Attempt and transaction-transcript bindings prove that they belong to the same operation.
2. Entry context
The app verifies the relevant cell, entry point, and gateway context.
3. Fresh challenge
The gateway creates a time-bound, single-use challenge for the new attempt.
4. Local approval
When policy requires it, the user approves the specific transaction on-device.
5. Proximity
A Standard BLE interaction or secure UWB distance evidence is produced.
6. Witness
The gateway carries the evidence and its observation in an authenticated envelope.
7. Decision
The server evaluates identity, freshness, replay, assignment, and policy atomically.
8. Receipt
A signed final result and an audit record with an explicit assurance level are produced.
Choose the profile that fits your risk.
Compare Standard and High Assurance at the mechanism level.