Understanding what Brainprint is.
A Brainprint is a privacy-preserving, tenant-scoped representation of how you interact with software.
It models an enrolled subject's interaction patterns: how you type, move the pointer and click, and scroll. The available signals vary by session. Not every modality is required or present.
01 / The timing
How you interact. Without what you type.
The typing scene illustrates one modality. The browser SDK derives timing and movement features, such as pauses, key intervals, and click rhythms. The evidence frames do not include typed characters or key codes.
- Movement intervals
- Key dwell & flight
- Bursts & pauses
Brainprint describes patterns of interaction, not the semantic content of what you type. This artwork does not measure your behavior.
02 / The boundary
A model scoped to your environment.
Brainprints are scoped to the customer and tied to an enrolled, pseudonymous subject. Enrollment, recovery, revocation, and deletion belong to that scope. They are not a universal identifier across websites.
- Customer-scoped
- Revocable
- Deletable
Continuity is evidence. It does not, by itself, prove identity, permission, legitimate intent, or authority to execute an action.
03 / The action
Fresh evidence. At the moment it matters.
Brainprint contributes behavioral evidence alongside context from your existing stack. GrayPass evaluates typed assurance against your policy for a registered action. Your application enforces the returned decision.
- Evidence with limits
- Your action policy
- Your application enforces
The core decision API is in beta. Continuity signals remain experimental for sandbox and shadow evaluation, with no calibrated confidence or approval for live enforcement.
04 / The boundary
Before the action becomes real.
Your application registers the actions that carry consequence. Before one of them executes, your server asks GrayPass about that exact request: subject, action, resource, and context.
A decision comes back to your server, and your application enforces it. Nothing executes until you decide, and your existing identity stack stays in place.
Registered actions start in shadow mode: GrayPass evaluates every request while production behavior stays exactly as it is.
05 / The evaluation
Multiple signals. One decision.
Evidence arrives from your stack and from Brainprint: identity provider, passkey or device, session, transaction context, and behavioral continuity.
GrayPass turns it into typed claims, each with its own coverage, freshness, and limitations. Your policy states what the action requires, and one decision comes back.
06 / The outcome
Not every action should pass.
Every request resolves to one of four decisions, with reason codes your team can read: allow, verify again, hold, or deny.
When evidence is insufficient, GrayPass says so instead of guessing. Your application chooses the response: your existing step-up, a pause for review, or a stop.
07 / The role of Brainprint
Brainprint is evidence. Not permission.
Brainprint is one evidence source among several. Continuity can indicate that the enrolled operator still appears to be in control, that the operator changed mid-session, or that the interaction looks automated.
It does not establish legal identity, intent, or permission, and it cannot prove the original enrollment was honest. No behavioral signal survives a fully compromised endpoint.
The decision belongs to your policy; enforcement belongs to your application.