Availability and outages

An issuer outage prevents new sign-ins and token refresh. A management or network outage can interrupt current eligibility delivery. Products may continue protected workforce access only while their last verified signed receipt remains valid, at most 60 seconds from issue.

Product behavior

Poll the lifecycle feed every 15 seconds. Apply through the signed receipt head before accepting it. If the feed fails, a sequence gap appears, or a receipt expires, close protected workforce routes until recovery and catch-up. An application can still serve public information or unrelated anonymous flows. Local sign-out should remain possible without fresh eligibility.

Delivery behavior

Approved governance actions are queued with durable work. pending means the product has not confirmed application. A product acknowledgement moves the exact projection toward effective status. Mail’s queued or sent message state is not proof that a holder received it; failed or ambiguous delivery leaves an invitation or recovery incomplete.

Recovery procedure

Restore the failed service or connectivity, validate its issuer and signing keys, request a signed snapshot if the product’s cursor is invalid, apply it transactionally, resume ordered events, then acknowledge the committed sequence. Reopen protected access only after a fresh receipt and local permission check. Operators should inspect /v1/operations/diagnostics and project diagnostics for stuck work and acknowledgement lag.

Availability targets and recovery times require measured drills in the deployment’s private runbooks. A documentation page is not evidence that a production target has been met.