How offline access works — on-device verification, syncing, and conflicts

The point of Access Control is that the door still opens when the internet does not. Here is what is actually happening behind the keypad, so you know what to expect during an outage.

An encrypted list lives on the device:
Your org's codes are pre-downloaded to the device as an encrypted allow-list. Only the code hashes and their labels are held, and they are stored encrypted — the plaintext code numbers are never on the device or the wire. That cached list is what the keypad checks against when there is no signal.

Online vs offline decisions:
- When you are online, the verdict is authoritative — the server decides using the freshest revocation state and records the event as it happens.
- When you are offline, the device decides locally from its cached list, grants or denies with a reason, and queues the event to sync later. If the network drops mid-check, it falls back to the offline path under the same event id, so a lost response can never double-log an entry.

Syncing when you reconnect:
Every offline entry is held in a durable queue and replayed to the server the moment connectivity returns. Replay is idempotent — reconnecting, refreshing, or losing the response again will not create duplicate log entries. The status line shows how many events are still syncing.

Conflicts — the "to review" badge:
If a code was granted offline but the server later finds it had already been revoked, that entry is flagged as a conflict and surfaced as a small "to review" count on the status line. The door already opened in that moment; the flag is there so you can see it and follow up. The exposure window is only as long as the cached list was stale, so a device that syncs often keeps that window small.

Keeping a device ready for an outage:
Because verification runs against the cached list, a device does best when it has had recent connectivity to refresh that list. Keep the device signed in and let it sync when it has signal, and it will carry a current set of codes into the next outage.