The record · why it is built this way
Every decision, its reason, and where to see it
Sixteen decisions, each stated with the reason and a link to the screen or page that proves it. Written to be quoted. Everything here is in the prototype today unless the row says otherwise.
1. One door, not three
Decision. Today Meri Pehchaan is a brand over three identity providers — DigiLocker, e-Pramaan and Jan Parichay — and the sign-in page asks the citizen to choose one. The concept routes by the identifier the citizen types; the hub works out which provider it belongs to.
Reason. A citizen should never have to know which arm of the state holds their record. The choice existed for the platforms' convenience, not the citizen's.
See it: /today · /id/signin
2. A verb on the button, one language at a time
Decision. The button says "Sign in" — never "Login with", never "Powered by", never a provider's name — and switches language with the page rather than stacking two scripts.
Reason. Recognition comes from the mark and the verb, the way "Pay by UPI" is recognised. A provider's name on the button reintroduces the choice the button exists to remove.
See it: /dev#button
3. Tiers named as words a citizen can say
Decision. Assurance levels are Shabda (a code to your number), Anumaan (proven from records) and Pratyaksh (proven with a device you hold), with Adhikrit for acting under a grant — not L1/L2/L3 and not a percentage.
Reason. gov.br shows a trust tier as a named ladder with one explicit next step; percentage meters demotivate when progress is slow by design. A citizen stuck at 40% reads a verdict; a citizen with three named tasks reads a list.
See it: /id/dashboard · /dev#tiers
4. Step up in place, never send the citizen away
Decision. When a service needs a higher tier than the sign-in reached, the consent screen says which one and offers the proof there — a record from its issuer for Anumaan, a passkey for Pratyaksh — and re-submits the consent.
Reason. The moment of need is the moment of proof. A redirect to a settings page loses the citizen and the department.
See it: /id/consent
5. Signing in is not sharing
Decision. The consent screen itemises what a service will read and what it will never receive; the optional rows are unticked; a private app receives a pairwise identifier and an over-18 answer, never a date of birth or an Aadhaar number.
Reason. Authentication and disclosure are different operations. A bank and a social app need different things from the same identity, and the citizen should see the difference on the screen, not in a policy.
See it: /id/consent · /portal/social · /portal/bank
6. Delegate authority, not credentials
Decision. A helper — a family member, a service-centre operator, a professional — asks for one permission, which the citizen approves on their own phone by matching a number. The helper signs in as themselves; the department records "helper, for citizen, under grant"; the citizen can end it in one tap.
Reason. The unsafe workaround in India is OTP sharing. The fix is not a rule against it but a way to help that never needs the code.
See it: /help · /id/access
7. Who has access is on the home, not in settings
Decision. Every service that can read something, every helper acting under a grant, and a revoke on each row, sit on the citizen's home screen.
Reason. This is the whole argument of 2.0: a citizen can see and end access without hunting. A settings sub-page is where such things go to be forgotten.
See it: /id/dashboard
8. Freeze is on the home screen
Decision. One control stops every sign-in and every permission immediately, reversibly, from any device the citizen holds.
Reason. Recovery starts from panic, and panic does not navigate. It is reversible so that fear never costs an identity.
See it: /id/dashboard
9. One identity does not mean one database
Decision. The hub answers who signed in, what was consented and what was delegated. Departments keep their own records and their own sessions; back-channel logout tells them when a session ends.
Reason. A national identity layer that also observed everything a citizen did would be a surveillance layer. The prototype separates identity from activity by construction, not by policy.
10. It looks like the government, on purpose
Decision. The concept is built from the government's own component library and tokens, with six classes added and nothing overridden.
Reason. A department can paste the markup into the page it already runs. Adoption, not novelty, is the product; a custom look would have been a redesign no department could take.
See it: /about-this-demo#why-it-looks-like-this · /dev
11. Absence is a gap, imprecision is not
Decision. A field the citizen has not linked reads "Not linked yet — nothing would be shared" with its box off. A masked value is shown as masked.
Reason. Honesty on the consent screen is measured in what is not there: a missing record must never be filled with a sample, and a sample citizen's data must never flash for a real one.
See it: /id/consent
12. A passkey a fresh account can create
Decision. A person who signs up with their own number can reach the highest tier by creating a passkey in one tap on the consent panel; nothing needs a seeded account.
Reason. Judges, and later citizens, must be able to walk the whole thing as themselves. A demo that only works for the sample citizen proves nothing.
See it: /id/register
13. The authenticator lives on the phone
Decision. Every link to the authenticator shows a code to scan; the app renders as a phone column even on a desktop.
Reason. Approving with number matching only means something on a device the citizen holds. A desktop tab pretending to be a phone would teach the wrong habit.
See it: /id/security
14. Measured on this prototype, never a national statistic
Decision. The before-and-after counts are produced by running the flagship scenario against this hub and reading its ledger; the "before" is counted from the 1.0 replica each portal carries, line by line.
Reason. The judging brief asks for a measurable reduction. Numbers typed into a page are not a measurement.
See it: /stats
15. Twelve languages as page strings, translation as a mapped rail
Decision. Every control speaks twelve languages from strings shipped with the page; live page translation is mapped to the national language platform and switched off.
Reason. Authentication and consent are where misunderstanding causes harm, so the words must be right before they are many. No plugin URL could be verified, so none was invented.
See it: /about-this-demo#languages
16. OpenAI first, disclosed everywhere
Decision. The problem was chosen in ChatGPT from the research; OpenAI Codex wrote the entire backend across logged tasks, each with a verification script; Claude Code did design, documentation and front end.
Reason. The rules require the tooling to be meaningful and disclosed. It is measured from the commit history, not asserted.