Why some answers need a sign-in, and some don't
Why some questions open a sign-in first and some answer instantly: the five assurance levels behind every capability.
Not every question needs to know who's asking. "What time do you close today?" doesn't. "What's my balance?" does. Treating every question the same way — always requiring sign-in, or never requiring it — gets one of those two wrong.
Five levels, one declared floor per capability
Kav resolves identity through five assurance levels: anonymous, channel-verified, identified, entitlement-proved and strong. Every capability declares the minimum level its answer requires, and a specific binding of that capability may raise the requirement further — but never lower it below the capability's own floor.
Never supplied by the caller
Assurance is resolved from the session and the token, server-side — the same rule that governs identity generally: a capability that needs to know who's asking has no input field for an id at all. The caller cannot simply claim a higher assurance level any more than they can claim someone else's identity.
What a resident actually experiences
A public question answers immediately. A personal one opens a sign-in exactly once, at the point it's actually needed — not up front, and not skipped.
The standard this maps to
This isn't a bespoke Kav concept: assurance is carried as the OIDC acr claim, and a step-up in assurance is an ordinary OIDC re-authorization with acr_values, not a custom protocol invented for this platform.