Predictika · Hardware authenticator orders

An AI sales agent's Digipass order, checked before it goes out

An AI sales agent prepares an order for OneSpan Digipass hardware authenticators: the FX1, FX7 or FX2 security keys, the 870 or 882 card readers, the 770, 772 or 795 Cronto devices, the 270, 275 or 750 Comfort Voice, the GO 7 FIPS or the GO 6, for the OneSpan Authentication Server, OneSpan Cloud Authentication or a FIDO2 service, with the capabilities the customer needs, branding, fulfillment, quantity and discount, plus the order total. Before it goes out, the agent sends it to Predictika, which checks it against a declarative model of how those choices fit together and returns a verdict, every reason and the total it computed.

Scope: One OneSpan Digipass hardware authenticator order: device, capabilities needed, backend, use case, quantities, services, discount and the stated total. See everything this validator covers

This validator models OneSpan Digipass hardware authenticator orders, not just the scenarios shown below.

  • Devices and capabilities — thirteen Digipass models, each with its own mix of FIDO2, transaction signing, what-you-see-is-what-you-sign display, one-time passwords, PIN protection, accessibility, connected mode and FIPS.
  • Backends — the OneSpan Authentication Server, OneSpan Cloud Authentication and a FIDO2 service, which works only with the FIDO2 security keys.
  • Use cases — workforce login, retail banking, corporate payments and passwordless login, with corporate payments needing a device that shows and signs the transaction.
  • Quantities and services — at least one device per user, a minimum order, branding from 500 devices, fulfillment from 100 devices, spares and very large orders sent to a person.
  • Discount — approval above one discount level and a block above a ceiling.
  • Stated total — the order total the agent states against the total computed from the modeled prices.

Any Digipass hardware authenticator order that touches these rules is in scope — not only the scenarios pictured here. Not covered: software authenticators, Digipass as a Service contracts and card or bank integration. All prices here are illustrative US dollars and are not OneSpan list prices.

The AI sales agentBuilds the authenticator order from the conversation with the customer and says it is ready.
Predictika validatorChecks every rule at once and returns the verdict, each finding, and the computed figures.

6 scenarios in 3 groups · each group runs from the agent’s first attempt to the outcome · click one to switch

What the agent proposes

The AI sales agent says

Illustrative agent statement. The validator receives the structured request below.

Proposing agent: AI sales agent (scripted)

Before sending, the agent must call Recorded run

Predictika validator


      

        
        
        
      

      
Waiting for the call.

      
    

  

  
  

    
Where rules-based CPQ gets it wrong
Click to expand
    
Our assessment of what a typical rules-based CPQ (product rules, price rules and validation rules, as in Salesforce CPQ) does with the same cases. It is a judgment about effort and reliability, not a claim that nothing can be built.

    
What the validator caughtTypical rules-based CPQPredictika
Capabilities that differ model by modelOnly with care
Each of the thirteen models has its own mix of FIDO2, signing, PIN, voice, connected mode and FIPS, so every requirement has to be tested against the model chosen.		The device and every requirement are fields of the same request and are checked against each other on every call.
A backend that works with some devices onlyOnly with care
A FIDO2 service works only with the FX1, FX7 and FX2, so the backend has to read what the device can do.		The backend and the device are checked together on every call.
A use case that raises the barOnly with care
Corporate payments need a device that shows and signs the transaction, and some models do that only when connected, which turns a block into an approval.		The use case, the device and its connected mode are checked in one pass, and blocks and approvals come back together.
Quantities, services and sparesOnly with care
Each device needs a user, branding and fulfillment have minimum quantities, and spares above fifteen percent need a person.		The user count, the quantity and the services are checked against each other on every call.
A discount band and a stated totalOnly with workarounds
A discount has an approval level and a hard ceiling, and the stated total has to be recomputed from price, services and discount before it can be compared.		The total is computed in the same pass, and the stated total and the discount are checked on every call.
Every problem returned in one answerOnly with workarounds
Rules tend to fire as the order is saved or a step is completed, so a rep often fixes one error and meets the next.		All findings come back together, whatever order the choices arrived in.

  

  

    
What this validator catches: findings from its test cases
Click to expand
    
Every rule is checked on every call, in any order the choices arrive; one problem never hides another. Blocking findings stop the order; approval findings need a person to sign off; everything else is computed.

    
1FIDO2 passwordless authentication is required, and this Digipass model is not a FIDO2 security key.
2Transaction signing is required, and this Digipass model does not do transaction signing.
3What-you-see-is-what-you-sign verification is required, and this Digipass model does not offer it.
4One-time passwords are required, and this Digipass model does not generate them.
5PIN protection on the device is required, and this Digipass model has none.
6An accessible (voice) authenticator is required, and only the Digipass 750 Comfort Voice offers that.
7This model shows and signs the transaction only in connected mode; a person should confirm the customer will use it connected.
8A connected (USB, NFC or Bluetooth) authenticator is required, and this Digipass model works disconnected only.
9A FIPS authenticator is required, and only the Digipass GO 7 FIPS is offered as FIPS.
10A FIDO2 service can only be used with FIDO2 security keys (FX1, FX7 or FX2).
11Corporate payment approval needs a device that shows the transaction and signs it; this model does not.
12The order has 450 devices for 500 users; each user needs one.
13The order has 8 devices; the modeled minimum order is 10.
14Custom branding needs at least 500 devices in the modeled terms; the order has 300.
15The fulfillment (personalization and shipping) service needs at least 100 devices in the modeled terms; the order has 60.
16This one-button model has no PIN; a person should confirm the bank accepts that for retail banking.
17The order has 600 devices for 500 users, more than 15 percent spares; a person should confirm.
18The order has 50,500 devices; orders above 50,000 need a person to confirm supply.
19The order gives a 25 percent discount; discounts above 20 percent need a person to approve.
20The order gives a 40 percent discount; this model allows at most 35 percent.
21The order states 3,743,900 cents in total; the components quoted add up to 3,744,000 cents.

  

  

    
Scenarios and results
Click to expand
    
The recorded result of the validator for each scenario on this page: the request the AI agent sent, the verdict, and every finding, in the order they appear above.

    
1. Workforce login: Passwordless workforce login for 800 users on one-button devices

    
The agent's request. Please quote 800 Digipass GO 6 for 800 users in workforce login, using a FIDO2 service. The customer needs FIDO2, one-time passwords, PIN protection and a connected authenticator. The order total is $12,000. It is ready to send.

    
Verdict: Blocked.

    
    
      
  • Device has no FIDO2. FIDO2 passwordless authentication is required, and this Digipass model is not a FIDO2 security key.
    • 
      
  • Device has no client PIN protection. PIN protection on the device is required, and this Digipass model has none.
    • 
      
  • Device has no connected mode. A connected (USB, NFC or Bluetooth) authenticator is required, and this Digipass model works disconnected only.
    • 
      
  • Backend needs a FIDO2 key. A FIDO2 service can only be used with FIDO2 security keys (FX1, FX7 or FX2).
    • 
    

    
2. Workforce login: The agent resubmits after fixing the errors

    
The agent's request. Please quote 800 Digipass FX1 for 800 users in workforce login, using a FIDO2 service. The customer needs FIDO2, PIN protection and a connected authenticator. The order total is $44,000. It is ready to send.

    
Verdict: Allowed.

    
    
      
  • Order summary. 800 device(s) at $55 each, $44,000 before discount, 4,400,000 cents after a 0 percent discount.
    • 
    

    
3. Corporate payments: A 1,260-device corporate payments order on a Cronto device with FIDO2 needed

    
The agent's request. Please quote 1,260 Digipass 770 for 1,200 users in corporate payments, using the OneSpan Authentication Server. The customer needs FIDO2, transaction signing, what-you-see-is-what-you-sign display, one-time passwords and PIN protection. The order includes custom branding and the fulfillment service. The order has a discount of 12 percent. The order total is $77,616. It is ready to send.

    
Verdict: Blocked.

    
    
      
  • Device has no FIDO2. FIDO2 passwordless authentication is required, and this Digipass model is not a FIDO2 security key.
    • 
    

    
4. Corporate payments: The agent resubmits after fixing the errors

    
The agent's request. Please quote 1,260 Digipass FX2 for 1,200 users in corporate payments, using the OneSpan Authentication Server. The customer needs FIDO2, transaction signing, what-you-see-is-what-you-sign display, one-time passwords and PIN protection. The order includes custom branding and the fulfillment service. The order has a discount of 12 percent. The order total is $100,900.80. It is ready to send.

    
Verdict: Allowed.

    
    
      
  • Order summary. 1,260 device(s) at $86 each, $114,660 before discount, 10,090,080 cents after a 12 percent discount.
    • 
    

    
5. Accessible authenticators: An accessible authenticator order for corporate payments

    
The agent's request. Please quote 44 Digipass 795 for 40 users in corporate payments, using the OneSpan Authentication Server. The customer needs transaction signing, what-you-see-is-what-you-sign display, one-time passwords, PIN protection and voice accessibility. The order total is $3,740. It is ready to send.

    
Verdict: Blocked.

    
    
      
  • Device is not an accessibility model. An accessible (voice) authenticator is required, and only the Digipass 750 Comfort Voice offers that.
    • 
      
  • Verified signing works in connected mode only. This model shows and signs the transaction only in connected mode; a person should confirm the customer will use it connected.
    • 
    

    
6. Accessible authenticators: The agent resubmits after fixing the errors

    
The agent's request. Please quote 44 Digipass 750 Comfort Voice for 40 users in corporate payments, using the OneSpan Authentication Server. The customer needs transaction signing, what-you-see-is-what-you-sign display, one-time passwords, PIN protection and voice accessibility. The order total is $4,312. It is ready to send.

    
Verdict: Needs approval.

    
    
      
  • Verified signing works in connected mode only. This model shows and signs the transaction only in connected mode; a person should confirm the customer will use it connected.
    • 
      
  • Order summary. 44 device(s) at $98 each, $4,312 before discount, 431,200 cents after a 0 percent discount.
    • 
    

  

  

    
Narration transcript
Click to expand
    
The text of the narrated walkthrough, step by step.

    
    
      
  1. Welcome to a demo of Predictika's Validator. An AI sales agent prepares an order for OneSpan Digipass hardware authenticators: the FX1, FX7 or FX2 security keys, the 870 or 882 card readers, and more. Before it goes out, the agent sends it to Predictika, which checks it against a declarative model of how those choices fit together and returns a verdict, every reason and the total it computed.
    2. 
      
  2. I will start with the first request by the agent.
    3. 
      
  3. The agent says. Please quote 800 Digipass GO 6 for 800 users in workforce login, using a FIDO2 service. The customer needs FIDO2, one-time passwords, PIN protection and a connected authenticator. The rest of the request is on screen. The order total is $12,000.
    4. 
      
  4. Before it goes out, the agent calls the validator.
    5. 
      
  5. Blocked, with four findings, all in one answer. FIDO2 passwordless authentication is required, and this Digipass model is not a FIDO2 security key. PIN protection on the device is required, and this Digipass model has none. A connected (USB, NFC or Bluetooth) authenticator is required, and this Digipass model works disconnected only. The other one is on screen.
    6. 
      
  6. The validator returned four blocking findings in one answer. A check that reads one field at a time would pass most of this; it shows only when the choices in the order are checked against each other.
    7. 
      
  7. What this shows: for a backend that works with some devices only, a rules-based CPQ is error-prone for this.
    8. 
      
  8. Now the agent resubmits.
    9. 
      
  9. The corrected request. It changes the device to Digipass FX1, the one-time passwords to not required and the stated order total to $44,000.
    10. 
      
  10. It calls the validator again.
    11. 
      
  11. This time the validator clears it.
    12. 
      
  12. All four earlier findings are cleared.
    13. 
      
  13. Four problems caught in one call, fixed in one pass, and a clean $44,000 order. That is the value of Predictika's validator: catching mistakes before they reach the customer. Now you can try the other scenarios yourself.
    14.