Security that stays out of the way

Design brief · shared-device security

The question

How do you make authentication reliable without making it visible?

In a boutique, the advisor and the customer share one screen carrying client profiles. Enterprise authentication — asking constantly — works in an office and fails here: every prompt interrupts the relationship the product exists to support.

Design model · ordinary vs. sensitive moments

The approach

I treated authentication as part of the service flow rather than a login module in front of it. Most of an interaction carries no risk and should ask for nothing; verification concentrates on the few moments that genuinely warrant it, and the rest of the time it stays invisible.

That reframing is what made the model buildable: instead of one blanket rule, the service has ordinary moments and sensitive ones, and only the second kind pays a cost. I worked this out with the cybersecurity team — my side was the service design and the flows, theirs was the security architecture. Where the two met is where the design actually happened.

We also looked at the physical side of the problem: what an advisor carries or wears, and how a verification gesture can feel deliberate and elegant instead of bureaucratic. The resulting Technology Evaluation used a Luxury UX Score — elegance of gesture, boutique fit, and impact on speed, discretion and naturalness — as design research rather than product selection.