Glossary
What is a scan session?
A scan session is the window opened when staff scan a customer. Every action afterwards carries the session rather than re-presenting the customer's code. The window is absolute, not idle: acting inside it does not extend it, and when it expires staff must scan again.
The scan session is what stops a single scan becoming unlimited access to a customer’s account.
Absolute, not idle
The deadline does not move when staff act. An idle timeout would let anyone acting every couple of minutes keep a session alive indefinitely, which is the exact behaviour the bound exists to prevent.
Bound to a person and a place
A session belongs to the staff member who opened it, at the venue they opened it from. Somebody else’s session is refused, and is refused in a way that looks identical to an expired one.
Expiry does not cancel a pending approval
If a customer has already been asked to approve something, that request keeps its own clock. They were asked a question and they get to answer it.