Update to Formify

{
  "description": "Verify a signer with BankID, ID scan, face liveness or company lookup. Use when a signature needs proof of who signed, for KYC or anti-money-laundering, when scanning an ID document, or when verifying a company registration number. Triggers on \"BankID\", \"ID scan\", \"verify identity\", \"KYC\", \"AML\", \"face liveness\", \"legitimering\", \"identitetskontroll\", \"verificar identidad\". Not for ordinary signing without identity checks: see formify-send-contract.",
  "included_files": [
    {
      "relative_path": "agents/openai.yaml",
      "size_in_bytes": 484
    },
    {
      "relative_path": "references/tink-attributes.md",
      "size_in_bytes": 11596
    }
  ],
  "name": "formify-verify-identity",
  "skill_md_contents": "---\r\nname: formify-verify-identity\r\ndescription: 'Verify a signer with BankID, ID scan, face liveness or company lookup. Use when a signature needs proof of who signed, for KYC or anti-money-laundering, when scanning an ID document, or when verifying a company registration number. Triggers on \"BankID\", \"ID scan\", \"verify identity\", \"KYC\", \"AML\", \"face liveness\", \"legitimering\", \"identitetskontroll\", \"verificar identidad\". Not for ordinary signing without identity checks: see formify-send-contract.'\r\nlicense: MIT\r\nmetadata:\r\n  version: \"1.6.5\"\r\n---\r\n\r\n# Verify who is signing\r\n\r\nVersion 1.6.5. If asked which version you are, quote this line.\r\n\r\n## Purpose\r\n\r\nBind a signature to a verified person or company. Formify can check an identity document,\r\nmatch a live face against it, authenticate through Swedish BankID, look up a company\r\nregistration number, or require a one-time code before a document opens — and attach the\r\nresult to the signature rather than leaving it as a separate errand.\r\n\r\n## When this applies\r\n\r\n- A signature needs proof of **who** signed, not just that someone did.\r\n- KYC or anti-money-laundering obligations apply.\r\n- A company must be verified, or its board member or beneficial owner identified.\r\n- An ID document must be scanned, or its data captured without storing the picture.\r\n\r\n## When it does not\r\n\r\n- **Ordinary signing with no identity requirement** → `formify-send-contract`.\r\n- **Building the PDF fields themselves** → `formify-pdf-forms`. This skill decides *what*\r\n  verification is needed; that one writes the fields it needs.\r\n\r\n## Preconditions\r\n\r\n**Every feature here is gated on the account, and you must check before offering.** Call\r\n`get_account_capabilities` first. Offering BankID to an account that does not have it wastes\r\nthe user's time and ends the conversation badly.\r\n\r\nThe keys that matter here:\r\n\r\n| Key | Unlocks |\r\n|---|---|\r\n| `signatureBankId` | BankID signing |\r\n| `signatureIdScan` | ID-document scan as part of signing |\r\n| `signatureFaceLiveness` | Live face check |\r\n| `verificationEmail` / `verificationPhone` | One-time code before the document opens |\r\n| `verificationToOpen` | Requiring that code to open at all |\r\n\r\nIf a needed capability is off, say what it would do and what it needs, then offer the\r\nstrongest option the account *does* have. Never silently downgrade.\r\n\r\n## Two separate layers — do not confuse them\r\n\r\nThis is the distinction that causes the most expensive mistakes.\r\n\r\n| Layer | What it is | Where it is set |\r\n|---|---|---|\r\n| **Signing method** | How the person signs and authenticates | On the signer, when the document is sent |\r\n| **Document fields** | What is collected or verified *inside* the document | `tink-*` attributes in the PDF, built beforehand |\r\n\r\nA company check inside a form is a **field**. BankID as the signing method is a **signer\r\nsetting**. They are configured in different places, at different times, and one does not\r\nimply the other.\r\n\r\n## Procedure\r\n\r\n### 1. Ask what the user actually needs to prove\r\n\r\nNot which feature they want — what they need to be true. There are four distinct answers,\r\nand they lead to different places:\r\n\r\n- *\"I need to know this is really them.\"* → a signing method.\r\n- *\"I need their passport details in the document.\"* → document fields.\r\n- *\"I need to check the company is real and who can sign for it.\"* → company verification\r\n  fields.\r\n- *\"I need a record for compliance.\"* → KYC, which is a specific variant, not a synonym.\r\n\r\nOne question at a time. If they name a regulation rather than a feature, translate it —\r\nSwedish AML obligations under money-laundering rules usually mean company verification plus\r\nretained identification, not a face check.\r\n\r\n### 2. Choose the signing method\r\n\r\nFour values. Each is gated as shown above. They differ in what they prove, not in a\r\nranking Formify publishes — do not tell a user that one satisfies a legal signature\r\nclass the others do not.\r\n\r\n| Method | What the signer does |\r\n|---|---|\r\n| `digital_ink` | Draws a signature. Always available, no capability needed. |\r\n| `bankid_identification` | Authenticates with Swedish BankID |\r\n| `digital_ink_id_scan` | Photographs an identity document, then signs |\r\n| `face_liveness` | Live face check bound to the signature |\r\n\r\n**`digital_ink_id_scan` requires two boxes to be placed, not one:** the signature box and a\r\nseparate ID-scan box. Sending it with only the signature box configured is the single most\r\ncommon failure in this area — see `formify-send-contract` for placement.\r\n\r\nMethods are set per signer. Different signers on one document can use different methods.\r\n\r\n**All four work on a public link too**, with the same capability gates and the same two-box\r\nrule for the ID scan. The difference is that a link's signature entries are slots rather than\r\npeople, so the method is chosen per slot, before anyone is known — every person who opens that\r\nlink is verified the same way. That is usually the point: an intake form that requires an ID\r\nscan verifies whoever turns up, without the sender knowing their name in advance. Placement is\r\nstricter there — a link inherits no coordinates from anything, so every box must be given\r\nexplicitly. See `formify-share-link`.\r\n\r\n### 3. Decide what goes inside the document\r\n\r\nOnly if data must live in the document itself. Read `references/tink-attributes.md` and\r\nfollow it exactly — the catalogue is closed and an unknown attribute fails silently.\r\n\r\n**Company verification.** Three triggers: beneficial owner, board member, and the KYC\r\nvariant whose result is retained for compliance. Each must be paired, in the same field\r\nname, with the field that receives the verified value — a trigger alone is a dead button.\r\nVerified company name, address, postcode and city can all be auto-filled.\r\n\r\n**Identity document capture.** Choose deliberately between the data and the picture:\r\n\r\n- Trigger alone → the field is replaced by the **front-side image** of the document.\r\n- Trigger combined with machine-readable-zone attributes → **no image is stored at all**;\r\n  the fields receive name, document number, nationality, dates and so on as text.\r\n\r\nThe second is the data-minimisation pattern and it carries legal weight: keeping a copy of\r\nan identity document needs its own legal basis. **When the user needs the details but not\r\nthe picture, say so and use it.** Most do not know it is an option.\r\n\r\n**One-time codes.** Email or SMS verification before the document opens. Not indexed, and\r\ngated on `verificationEmail` / `verificationPhone`.\r\n\r\n### 3a. Confirm identity-document copies\r\n\r\n**Identity-document copies — explicit confirmation.** The signature method\r\n`digital_ink_id_scan` embeds an image of the front of the signer's identity document\r\nin the signed PDF. Form fields containing a `tink-scan-id` trigger or a\r\n`tink-scanned-id-` image attribute can also embed an identity-document image; a\r\ntrigger combined with a `tink-scanned-id-mrz-` attribute on the same field instead\r\nfills that field with text. Inspect the actual signature settings and field names.\r\nBefore `create_document`, `send_draft`, `create_link`, or `duplicate_link` creates\r\na live workflow containing an identity-document image, explain that the image will\r\nremain in the signed PDF, ask whether the sender has a legal basis for retaining\r\nit and wants to proceed, and wait for an explicit yes. Include this in the final\r\nconfirmation summary. Template defaults and copied settings do not waive this\r\ncheck. Offer MRZ text fields or another signing method when an image is not needed;\r\ndo not change the chosen method silently. The signer performs the verification\r\non Formify's signing page; this skill configures that workflow and must not ask\r\nthe user to supply an identity-document image or a biometric recording in chat.\r\n\r\n### 4. Do not make them scan twice\r\n\r\nIf a signer will both scan a document and pass a face check, combine\r\n`tink-scanned-id-allow-in-signature[index]` on the scan trigger. A **fully successful** scan\r\nis then carried into the Live ID signature and the signer goes straight to the face check\r\nwithout photographing anything again. The face check itself still runs.\r\n\r\nAn incomplete scan is never reusable. The index here is the scan group, not a signature\r\nnumber.\r\n\r\n### 5. Say what will happen, in the signer's terms\r\n\r\nBefore sending, tell the user what the person on the other end will experience:\r\n\r\n> Maria will get an email, open the document, be asked to photograph her ID card, then take\r\n> a short video selfie so we can confirm it is her. Then she signs. It takes about two\r\n> minutes.\r\n\r\nIdentity checks are the step that makes recipients abandon a document. A sender who knows\r\nwhat it looks like can warn them, and completion rates hold.\r\n\r\n### 6. State the boundary honestly\r\n\r\nSelecting a verification method configures a check. It does not, by itself, establish a\r\nlegal signature class, guarantee acceptance in a given jurisdiction, or constitute a\r\ncompliance programme. If the user asks whether this satisfies a specific regulation, say\r\nwhat the product does and does not decide, and let them confirm with their own adviser.\r\n\r\nDo not describe a document as \"KYC compliant\" because it carries a KYC trigger.\r\n\r\n## Failure modes\r\n\r\n| What you see | What it means | What to do |\r\n|---|---|---|\r\n| A method is not offered | The capability is off for this account | Say which one and what it does; offer the best available alternative. |\r\n| ID-scan signing fails at send | The ID-scan box was not placed | Both boxes are required for that method. Place it and resend. |\r\n| The verification button is not clickable | Trigger has no paired value field, or the field is not read-only | Pair it; set read-only on the widget itself. |\r\n| The scan runs twice | Two triggers in one group, or the reuse modifier is missing | One trigger per person; add the modifier if a face check follows. |\r\n| Fields never fill after a successful scan | Brackets missing, or indices renumbered when a person was inserted | Check the index on every field of that group. |\r\n| An ID image appears when the user wanted only data | Trigger used alone | Combine with the machine-readable-zone attributes. |\r\n\r\n## References\r\n\r\n- **`references/tink-attributes.md`** — the complete catalogue of document markers, their\r\n  combinations and required image shapes. Open it before writing any attribute; an invented\r\n  one produces a document that looks correct and does nothing.\r\n"
}