Viewer authentication
The Viewer's identity model follows one principle:
Identity is required exactly when an action produces attributable trust. Everything else stays anonymous and frictionless.
Verifying a document is a local, deterministic computation - it proves nothing about who you are, so it never demands a login. Gaining hosted access, or producing a signature attributed to an organization, does create an attributable claim, so it requires authenticated identity.
When identity is required
| Action | Desktop Viewer | Web Viewer |
|---|---|---|
| Open and verify a document | No login | Login required (to reach the app) |
| Inspect signatures, lineage, proofs | No login | Login required |
| Decrypt access-controlled payloads | Per document policy | Per document policy |
| Sign a document as an individual | Login per signing identity | Login required |
| Sign a document under an organization | Login required | Login required |
The desktop column is the important one: viewing and verifying are anonymous by default, but organization-scoped signing always requires login. There is no unattributed org-scoped signing - a signature that asserts "signed on behalf of this organization" must be backed by an authenticated, org-resolved identity.
Web Viewer - login gated
The Web Viewer requires authentication before it loads, because hosted access is itself an attributable event. The identity provider depends on deployment mode:
- Commercial mode - sign-in with Microsoft Entra ID.
- Governance mode - sign-in through the governance gateway, which brokers an approved authenticator: Login.gov, the Companion app, or a smart card (CAC/PIV).
In both modes the authenticated session also carries org policy, including any plugin allowlist/denylist and capability scoping. See Plugin governance.
Desktop Viewer - optional for viewing, required for org signing
On the desktop, login is optional for viewing and verifying. You can open a file from disk or removable media, verify it fully, and inspect its evidence with no account at all - the verification core needs no identity to do its work.
Login becomes mandatory the moment you sign under an organization:
- Individual signing binds to a signing key you control.
- Organization-scoped signing binds the signature to an org identity and requires an authenticated session that resolves you within that organization. Without it, the Viewer refuses to produce an org-attributed signature.
This keeps the common case - read and verify - frictionless, while ensuring every org-attributed claim has a real, resolvable signer behind it.
Companion Agent SSO handoff
When the Companion Agent is present, the desktop Viewer can obtain its session through an SSO handoff rather than prompting separately. The Agent holds the authenticated session and brokers tokens to the Viewer, so signing in once at the device level flows through to org-scoped signing without re-authenticating per action.
Offline and cached-lease behavior
Identity and policy are designed to survive disconnection on the desktop:
- An authenticated session can be cached as a lease with a bounded lifetime. While the lease is valid, org-scoped signing continues to work offline.
- When a lease expires and no connection is available, the Viewer fails closed for attributable actions - viewing and verifying still work, but org-scoped signing is withheld until the session is refreshed.
- Access-controlled payloads follow the document's own policy; leases never widen access beyond what that policy grants.