Capture trusted liveness evidence before provider expiry

When a verification workflow can outlast an Amazon Rekognition Face Liveness session, replacing client-supplied scores with a late provider lookup can break legitimate completion. Capture the provider result server-side while it remains available, bind it to the authorized application attempt and reference image, and consume that trusted record idempotently. A score merely copied into a server-written row still has client provenance. Keep provider retrieval lifetime separate from the application's explicitly defined evidence-validity policy; persistence must not silently permit indefinite reuse. This design requires testing delayed completion, expired uncaptured sessions, mismatched attempts and image substitution.

Applies when: client workflows may submit verification evidence after short-lived provider results expire. Keywords: Amazon Rekognition liveness expiry provenance reference image verification retry