One resident login across agency services: what it takes

Reference article · 5 min read

Most agencies already operate an identity system for employees. It serves a known population, issues credentials through a hiring process, and revokes them when someone leaves. Resident identity differs at every step. The population is unknown and self-declared, nobody onboards a resident, and the agency often has no prior relationship with the person creating the account.

The goal is easy to state: one login for paying a utility bill, pulling a permit, and checking a court case. Reaching it means answering three questions that are often treated as one. How much proof does each transaction require, how does a resident get back in after losing access, and how does a new account connect to records the agency created years earlier.

Why resident identity is its own problem

Self-registration. Anyone can create an account, and at creation it holds a claimed email address, not a verified person. Duplicates are normal.
No help desk relationship. Residents reach a call center or a counter, not IT. Recovery must be something clerks can perform from a written procedure.
Infrequent use, no offboarding. Many accounts are used once a year, and people move, sell property, and die without any personnel feed telling the system.

Proof only what the transaction requires

Treat proofing and authentication as separate dials. Proofing establishes who a person is at enrollment. Authentication establishes that the same person is returning. The NIST digital identity guidelines, SP 800-63, treat them as distinct assurance levels. They are revised periodically, so confirm the current version and any state requirements with the official source or your counsel.

Many resident transactions need reasonable authentication and no proofing: paying a bill with an account number the resident already holds or subscribing to notifications. Others need it, such as changing the mailing address of record or filing under penalty of perjury. The pattern that works is an open account at registration and a step-up at the transaction that requires more. Avoid knowledge-based questions drawn from credit files; that data circulates too widely to prove much.

Account recovery is the hard part

Recovery, not login, is where these programs fail. Many residents lack stable email or a mobile number that survives a change of prepaid plan.

More than one channel. Email, text message, and a code mailed to the address of record.
Postal mail as proofing. Slow, inexpensive, and tied to an address the agency already holds.
In-person recovery. Counter staff verify identity documents and trigger a logged reset.
Delegation. A property manager, a contractor pulling permits for an owner, and an adult child helping a parent are ordinary cases.

Linking an account to records the agency already holds

An account that cannot see the resident's permit or bill is only a login, and a wrong match is a disclosure incident.

Require a claim code the resident already holds. A utility account number plus the last payment amount, a permit number plus the parcel, a citation number plus date of birth.
Do not match on name and address alone. Common names, unit numbers, and stale addresses produce false matches.
Never use the Social Security number as an identifier or a linking key.
Keep links reversible and audited. Unlink when a property sells or a tenant moves.
Treat court records separately. Access is set by court rules and statute, and the clerk of court decides who may see what.

Three architectures

Run a customer identity platform. One account store, integrated with each system through OpenID Connect or SAML. Maximum control and maximum responsibility: the agency owns proofing, recovery, and the personal data.
Federate with an existing credential. A federal shared credential service, a state resident credential, or an approved commercial provider. Residents reuse a credential they already have, and the agency avoids running proofing and recovery. Availability, eligibility, and cost vary by program and by state, so verify them directly. Federation still leaves record linking to the agency.
Leave each system separate. No project and no new data store, but residents keep several logins and each vendor's recovery quality is its own. For a small agency that is sometimes the honest answer, if it is a decision, not a default.

A front door that also accepts a federated credential is a common hybrid.

Privacy and public records implications

The account is itself a record. It needs a retention schedule, an access rule, and a disposition method before launch.
Aggregation raises sensitivity. A profile linking utility usage, permits, and case involvement reveals more than the parts. Store little in the identity layer and read through to the source systems.
Disclosure exposure. Resident account data may fall within public records law, with exemptions that vary by state. Ask counsel which elements are exempt before the first request arrives.
Address confidentiality. Many states shield the addresses of survivors of domestic violence, and linking and mailed codes must respect those programs.

What to ask vendors, and how to start

Inventory every resident-facing transaction and mark the assurance each one genuinely requires.
Ask each line of business vendor, in writing, whether it supports OpenID Connect or SAML for public users, in which release, and at what license cost.
Require standards-based integration, export of the account store in a documented format, agency ownership of resident identity data, and pricing that does not penalize adoption per account.
Ask how a resident with no email and no mobile phone recovers an account, and require a demonstration.
Require audit logging of registration, linking, step-up, and recovery, then pilot with one high-volume, low-assurance service before adding a proofed one.

HQT works with state and local agencies on resident-facing identity architecture, integration with line of business systems, and the records questions that come with consolidating accounts.

Frequently asked questions

Do residents need identity verification to create an account for agency services?

Not for most transactions. Identity proofing and authentication are separate decisions, and paying a bill with an account number the resident already holds or subscribing to alerts generally needs neither proofing nor a verified identity. Proofing belongs at the transactions that carry real consequence, such as changing the mailing address of record or filing a document under penalty of perjury. The usual reference is the NIST digital identity guidelines, SP 800-63, which are revised periodically, so confirm the current version.

How is a customer identity platform different from the identity system we use for employees?

Employee identity manages a known population with a hiring event and a termination event for every person, driven by an HR system. Customer identity, often called CIAM, manages self-registered members of the public whose accounts nobody creates or closes on the agency's behalf. The underlying protocols overlap, but registration, recovery, support volume, and fraud handling are different problems. Staff directory tooling is usually not designed for public self-service at resident scale.

Can a city or county use a federal or state credential instead of running its own resident login?

Sometimes. Several federal and state credential services accept partner agencies, and availability, eligibility, and fees vary by program and by state and change over time, so confirm directly with the operating agency. Federating removes the burden of running proofing and account recovery. The agency still has to link the credential to its own permit, utility, and case records, and still needs a path for residents who cannot or will not use that credential.

How does a resident recover an account without a stable email address or phone?

Provide at least one recovery channel that depends on neither. A one-time code mailed to the address of record works well, and in-person recovery at a counter, where staff inspect identity documents and trigger a reset, covers the rest. Write the procedure down, state who is authorized to perform it, and log every reset so the action can be reviewed later.

Are resident account records subject to public records requests?

Often, at least in part. Account data held by the agency is generally a public record unless an exemption applies, and exemptions for personal contact information, utility customer data, and court data differ by state. Ask counsel to classify each data element and set a retention schedule before launch rather than after the first request. Address confidentiality programs for survivors of domestic violence may also restrict what can be stored or disclosed.