When you walk away, should your network access stay behind?

An empty desk can still hold an active session

Picture a shared engineering space at the end of a meeting. A laptop remains open on a desk. Its owner has stepped into another room, carrying a phone. The laptop may still have a valid identity session and a route to private applications. Nothing in the original login necessarily describes the change that just occurred.

A presence-aware access policy asks a different question from a login prompt. It asks whether an additional condition remains true while work continues. In Antara’s enterprise client, Bluetooth proximity network access brings a registered companion into that context. The condition sits beside identity, device health, and application entitlement.

This does not mean that every nearby phone becomes a key. Nor should bringing the right phone back into the room undo a revoked account or a compromised endpoint. The value comes from adding a signal to a policy that already has a trustworthy foundation, then defining what happens when that signal changes.

Presence, possession, and identity are different claims

A receiver can observe a radio advertisement. An enrolled relationship can associate a companion with a user. A cryptographic exchange can demonstrate possession of a key. These observations are related, but they are not interchangeable. Good access design states which claim each mechanism supports and where it stops.

FIDO cross-device sign-in is a useful comparison. Its flow uses Bluetooth Low Energy to establish proximity, while the security of sign-in does not rest on Bluetooth security properties alone. It illustrates why the proximity channel and the authentication mechanism deserve separate descriptions.¹

For Antara, the practical model is additive. Companion presence contributes to a network-access decision. It does not carry business traffic instead of the protected tunnel, and it does not replace the policy that identifies which application the user may reach. A clear explanation of these roles also makes support conversations much easier.

A radio signal is not a measuring tape

Received signal strength, commonly called RSSI, is affected by the environment between devices. Body position, walls, reflections, antenna orientation, and transmit power complicate any simple translation from a signal value to a distance. A threshold that behaves well on an empty desk may behave differently when the phone is in a bag.²

The trace is a constructed example of threshold behavior. One sample crosses the threshold during the first interval, then recovers. Later, several consecutive samples remain below it. A rule that reacts to every crossing creates a different experience from a rule that waits for sustained evidence. The chart illustrates that tradeoff; its numbers are not a calibration recommendation.

Filtering and a grace interval can reduce unnecessary interruptions, but they also change how long access remains available after genuine absence. There is no universally correct setting. An administration console, a shared workstation, and a long-running engineering task may need different policies. Describe the tradeoff in time and business impact, not just in signal units.

The feature is a control loop, not a switch

A useful design has at least four states: eligible, present, uncertain, and restricted. “Uncertain” is especially important. Bluetooth may be disabled; a device may be asleep; the companion may have run out of power. None automatically means an adversary is present. Yet a sensitive application still needs a defined response when required evidence is unavailable.

Session management guidance treats continued access and reauthentication as explicit concerns. An organization should decide how an absence event affects existing sessions, not assume that a fresh login is the only control that matters.³

The return path deserves equal attention. Require the full access policy to pass again. Give the user an intelligible reason when it does not. If a companion has been lost, the answer is controlled recovery and re-enrollment, not a hidden exception that disables presence checks indefinitely.

Better ranging does not eliminate the rest of security

Bluetooth Channel Sounding introduces phase-based ranging and round-trip timing. Bluetooth SIG describes security measures intended to resist distance-manipulation attacks. This is a distinct capability from treating ordinary RSSI as distance, and it depends on appropriate device support.⁴

That development is relevant to the future of presence-aware systems. It is not a reason to imply that every Bluetooth device, or every Antara deployment, already has those properties. A product evaluation should distinguish the current companion mechanism from future ranging options and ask how freshness, enrollment, and relay resistance are handled in the supported configuration.

Build a pilot around people moving

A desk-bound demonstration misses the point. Have participants move between ordinary work locations. Put phones in pockets and bags, close laptop lids, disable Bluetooth, replace a companion, and return after a restriction. Record both the security response and the person’s ability to recover.

• Measure time from sustained absence to the intended access restriction.
• Count unnecessary interruptions during normal working movement.
• Verify that enrollment, identity, and posture failures still block access.
• Test revocation and replacement of the companion.
• Review what presence data is retained, who sees it, and how long it remains.

Antara makes proximity part of the enterprise client rather than a detached reminder to lock a screen. Its strength should be evaluated at that boundary: does a change in presence produce the right change in access, with an explanation that users and administrators can understand? That is a more durable claim than promising an infallible invisible fence.