HIGH story-biometric-session-authentication-organization-admin-003 3 pts
3
Story Points
High
Priority
Biometric Session Authentication
Feature

User Story

As a Organization Administrator
I want to receive a clear and non-alarming message when my device does not support biometric authentication or when it is temporarily unavailable
So that I understand why biometric login is not offered and know what alternative I should use, without feeling that something is broken or that my account is compromised

Acceptance Criteria

  • Given my device has no biometric hardware, When biometric setup is attempted, Then a banner explains that biometric login is not available on this device and I am directed to use password login
  • Given my device has biometrics disabled at the OS level, When I attempt biometric login, Then a clear message tells me to enable biometrics in device settings or use password login instead
  • Given biometric authentication fails due to too many failed attempts and the sensor locks, When I open the app, Then I am immediately shown the fallback login screen with a plain-language explanation
  • Given the unavailability banner is shown, When a screen reader is active, Then the banner text is fully announced with appropriate semantics and focus is placed on the banner
  • Given the unavailability banner is shown, When I tap the fallback action button, Then I am taken to the standard password login screen without additional friction
  • Given biometric unavailability is detected, When I view the banner, Then it uses the design token color system with sufficient contrast ratio (minimum 4.5:1) for all text

Business Value

The three partner organizations collectively serve users with visual impairments, hearing loss, motor disabilities, and cognitive challenges. Many will use older devices. A confusing or alarming biometric failure state creates support burden and discourages app adoption. Plain-language, accessible fallback handling is explicitly required by the universal design mandate shared by all four organizations and is a prerequisite for WCAG 2.2 AA compliance.