Station login, badge at submit

The physical worldDashboardScanread_scopewrite_scoperequireActingIdentitybadge_grantX-LT-Acting-Remaining

A shared device signs in read-only; anyone edits the form, and the badge is asked for once, at the submit that changes the record.

The situation

A bench tablet stays signed in all day. People pick up a claimed item, type into its form, step away, and someone else finishes it. The record must say who submitted, and the device itself must never be able to change anything.

The recipe

Sign the device in as an ordinary station account that reads the queue and writes nothing:

curl -X POST https://lt.acme.dev/api/users/$STATION_ID/roles \
  -H "Authorization: Bearer $LT_TOKEN" -H 'Content-Type: application/json' \
  -d '{ "role": "packing", "type": "member", "read_scope": "all", "write_scope": "none" }'

Set the bench’s badge policy on the role:

{ "properties": { "kiosk": true, "badge_grant": { "ttl_seconds": 600, "max_uses": 0 } } }

On the work form, editing needs no badge. The form warns who the submit will act as, and the submit opens a badge prompt naming the claimant. The resolve fires the moment a matching badge primes. A live grant that names the claimant and has uses left carries the submit without a prompt.

The guarantee

write_scope: 'none' is the structural backstop: even a misconfigured rule cannot mutate as the station, because the RBAC write gate denies the account itself. It is also what makes the badge challenge fire, since a login with its own write scope satisfies requireActingIdentity by itself. A badge that is not the claimant’s is named and the submit is held. See Scan codes.

The physical world