Approving on your phone

In the tafs app, KIFF accepts an answer to a held call only with a signature made on your phone or iPad. A stolen sign-in cannot approve anything, because it has no key.

Two keys

The app holds two keys on the device, in its secure hardware:

The approval key signs only what grants authority. Its own access control requires Face ID or Touch ID (or your passcode, if the device has neither), so the check is made by the key, not just by the app.
The device key signs everything else, including answers that may be given with no one at the screen.

What needs Face ID or Touch ID

The approval key signs:

Approve once, and Extra room, which raises a Card for one held call;
confirming a draft, which issues a Card or starts a trial;
Resume, for one taf or for all of them (Halt and resume).

These steps ask for one Face ID or Touch ID each. When one step needs several signatures, such as installing a version and approving a call in Coach mode, one prompt covers them, for two minutes at most.

What does not

Refuse and Halt need no prompt, so you can stop a taf quickly, from a notification or with the phone locked. Neither can grant anything.

Registration

The approval key is registered with KIFF when you sign in. If you signed in before it existed, the app registers it once when it next opens, without a prompt. Signing out forgets the key.