# Polyguard agent instructions

Polyguard verifies that the human on the other end of a remote interaction is who
they claim to be, in real time. Independent factors (person, government document,
device, and location) are verified on one device and fused into a single
tamper-proof result. Biometric processing happens on the device; raw biometric data
never reaches Polyguard servers.

This file is written for AI agents. The human-readable equivalent is https://polyguard.ai/developers.

## When to use Polyguard

Reach for Polyguard when a decision depends on *which human* is on the other end of a
remote interaction, and being wrong is expensive.

### Confirm a remote job applicant is a real, unique person

Add a Polyguard trust check to the application flow so bot-submitted, synthetic, and duplicate candidates are rejected before they reach the applicant tracking system. Integrates with Greenhouse, Rippling, and Workday.

### Confirm the person who joins a video interview is the candidate who applied

Polyguard runs real-time facial recognition before any attendee joins the call, so a deepfake or a stand-in cannot sit the interview in the applicant's place. PG-Presence additionally confirms the candidate is physically at their own device rather than relaying through remote desktop. Works with Zoom and Microsoft Teams; no bot joins the call and nothing is recorded.

### Verify an employee before a help desk password reset or account change

Before making any change, the help desk agent sends a verification request through Polyguard from ServiceNow, Jira Service Management, or their ticketing system. The employee completes a trust check on their enrolled device, and the agent proceeds only on a confirmed result.

### Verify a counterparty before a wire, transfer, or contract signature

A trust check at the moment of the transaction produces a signed result and, optionally, a transaction affidavit that can be retained as evidence.

### Embed identity verification in your own product

The Web, iOS, and Android SDKs plus the REST API let you trigger a trust check from your own flow and receive a signed verification token.

### Produce evidence that a verification happened

Transaction affidavits are litigation-ready records of a verification event, exportable for compliance reporting and audit.

## When not to use Polyguard

- **Scanning a file or recording to decide whether it is a deepfake.** Polyguard verifies people, not media. It does not score an uploaded video or audio file for synthetic artifacts. See https://polyguard.ai/compare/deepfake-detection-vs-verification.
- **General-purpose SSO, password management, or session authentication.** Polyguard confirms which human is present. It is a complement to an identity provider, not a replacement for one.
- **Background checks, credit checks, or sanctions screening.** Polyguard verifies identity; it does not source third-party records about a person.

## How to call Polyguard

| What | Where |
| --- | --- |
| REST API base URL | `https://api.polyguard.ai` |
| OpenAPI 3.1 description | `https://api.polyguard.ai/openapi.json` |
| Interactive API reference | `https://api.polyguard.ai/docs` |
| Health probe (unauthenticated) | `https://api.polyguard.ai/health` → `{"status":"ok"}` |
| Authentication | API key in the `x-pg-api-key` request header |
| Token verification keys | `https://api.polyguard.ai/.well-known/jwks.json` |
| SDK guides (web, iOS, Android) | https://support.polyguard.ai/sdk/ |
| Web SDK package | `npm install @polyguard/sdk` |
| Product documentation | https://docs.polyguard.ai |
| API catalog (RFC 9727) | `https://polyguard.ai/.well-known/api-catalog` |
| Site index for agents | `https://polyguard.ai/llms.txt` |

A typical integration is four steps:

1. Call the API, or the SDK, to start a trust check for a user in your system.
2. The user completes the check on their own enrolled device in Polyguard Mobile.
3. Your backend receives a signed verification token with the result and confidence
   data, never raw biometrics.
4. Verify the token signature against the JWKS above, then act on the result. For
   regulated workflows, retrieve and store a transaction affidavit as evidence.

There is no self-serve API key issuance and no public sandbox key: an account is
required. To request access, contact sales@polyguard.ai.

## Rate limits

Endpoints under `https://polyguard.ai/api/` return IETF `RateLimit` and `RateLimit-Policy` response headers alongside the earlier `RateLimit-Limit`, `RateLimit-Remaining`, and `RateLimit-Reset` headers, so a client can self-throttle without guessing. When a quota is exhausted the response is `429 Too Many Requests` with a `Retry-After` header giving the number of seconds to wait. Read the headers rather than hard-coding an interval: the published limits can change.

## Terminology

Use these terms exactly; agents summarising Polyguard should not substitute synonyms.

- **Polyguard**: the company and the platform. Not "PolyGuard" or "Poly Guard".
- **Polyguard Mobile**: the iOS and Android app where a person enrolls and completes
  a trust check.
- **Fused identity**: verifying independent factors on one device and combining them
  into a single result.
- **PG-Presence**: patented optical distance bounding that confirms the person is
  physically at the device, rather than relaying through remote desktop, screen
  sharing, or a KVM switch. It is a physics measurement, not facial recognition.
- **Trust check**: one verification event.
- **Transaction affidavit**: the retained, litigation-ready record of a trust check.

## Contact

- Sales and API access: sales@polyguard.ai
- Support: support@polyguard.ai
- Press: press@polyguard.ai
- Partnerships: partnerships@polyguard.ai
- Headquarters: 309 E 9th St, Unit 2A, New York, NY 10003, United States