Onboarding an Identity: Registration and Identity Proofing

Before anyone gets a username to type, someone has to decide they're real and that they belong. That's registration, and it's the step where a surprising amount of fraud gets stopped, or waved straight through, depending on how many different people actually touch it.

The clean version is four steps, and the whole point is that they're four different people. Someone requests the account, usually a hiring manager. Someone else approves it. It has to be someone else, because a request that approves itself isn't a control, it's a formality. A registration authority, often HR, does the identity proofing: actually confirming this person is who they claim to be. And then, ideally a fourth person, issues the credential. Spread across four roles, no single insider can conjure an account out of nothing. Collapse it down to one busy admin doing all four, and you've rebuilt the exact gap fraudsters look for.

flowchart LR R["1 · Request<br/>(hiring manager)"] --> A["2 · Approval<br/>(different person)"] A --> P["3 · Identity proofing<br/>(registration authority / HR)"] P --> I["4 · Credential issuance<br/>(ideally a 4th person)"] R -. separation of duties .- I
Onboarding an Identity: Registration and Identity Proofing

Identity proofing is the part that decides how much you should actually trust the claim. NIST's 800-63A framework (revised in 2025) grades identity evidence by strength (FAIR, STRONG, SUPERIOR) rather than simply counting IDs: the higher the assurance level you need, the stronger, and often the more numerous, the documents have to be. In practice that still means leaning on strong, independent government photo IDs, and "independent" is doing real work: two documents from the same source prove far less than one each from two. In the US that's the usual set: driver's license, passport, state ID, military ID. Higher-assurance environments layer on more, and fingerprinting is routine in government, with a criminal background check where the role warrants it.

None of this is glamorous, and it's tempting to file it under HR paperwork and move on. But every authentication control downstream is only as trustworthy as this step. A flawless MFA setup on an account that was issued to the wrong person is a very strong lock on a door you already let the intruder walk through. Proofing is where you earn the right to trust everything that comes after it.