How Long a Phone May Work Without Asking
An app that works offline is also an app that keeps working after the account was suspended, the phone was reported stolen or the role was changed, until it next reaches the server. The offline trust window sets how long that can be, per role, and a workspace offline policy decides what kind of work may wait in the queue at all.
A field officer in Marsabit counts stock at three outposts over four days with no signal, and the app queues every count to send when she reaches town. That is exactly what offline mode is for. On day two, back in Nairobi, her supervisor learns the phone was left in a matatu and suspends her account. The server knows within a second. The phone, wherever it is, will not find out until it next connects.
Every offline-capable app has this property, and most leave it unstated. The phone is the only party present while it is offline, so the phone has to enforce whatever rules apply, using the last version of them it heard. The real question is not whether a phone can work offline but for how long it may go on trusting what it last heard, and what it may do in that time. We covered how the queue itself drains safely in offline sync, and how it works and why a retried sale is never recorded twice in the sale the till sent twice. This is the policy around it.
The offline trust window
Each role can carry an offline trust window, from one hour to thirty days. The clock starts at the last time the phone successfully fetched the security policy from the server, and every successful fetch resets it. While the window is open, offline work carries on as normal. Once it has lapsed, the app refuses to queue new work and will not replay what is already queued until it reconnects and fetches the policy again. The message is plain: reconnect to keep working offline, your device has been offline longer than your workspace allows.
A person with several roles gets the shortest window among them, the same strictest-wins rule the server applies to every per-role device rule. A storekeeper might be given three days, because outposts are remote and counts are low risk. A cashier who also runs the till might be given twelve hours, because a till that sells for a week on stale trust is a different exposure.
The workspace offline policy
| Limit | Range | Enforced by |
|---|---|---|
| Kinds of work allowed offline | Any of eight groups, from point of sale to approvals | The phone, and the server on replay |
| Oldest queued work accepted | 1 to 720 hours | The phone, and the server on replay |
| Most operations in the queue | 10 to 5,000 | The phone |
| GPS accuracy required | 5 to 5,000 metres | The phone, and the server where a fix is reported |
| Sign in again after offline for | 1 to 720 hours | The phone |
Every limit starts empty, which means the app’s own built-in limits apply and the server refuses nothing extra, so a workspace that never opens the setting behaves exactly as before. Where the server can check a rule when the work arrives, it does. Work of a kind the workspace does not allow offline is refused with a request to redo it while connected, and nobody can override that. Work queued longer ago than the workspace allows is refused too, but someone who manages device trust can review it and let it through, retry it against today’s figures, or discard it.
Five events end an offline session whatever the window says
A password change or reset, a change of roles, a device locked or revoked by an administrator, a suspended account, and a phone offline longer than the re-sign-in limit. The server revokes the session, so the phone is signed out on its next call.
Offline is a loan of trust. The window says how long the loan runs before the phone has to come back and ask.
One phone, one identity
Every install of the app sends its own device id with each call. Device trust, device revocation and the binding of a scanner link all key on it, so a lost phone can be revoked on its own, without locking its owner out of the replacement. Combined with the trust window, that gives a bounded answer to the matatu question: the stolen phone keeps the access it had for at most the window you set, and loses it the moment it connects.
What AWRA OpsHub does today
- An offline trust window per role, from one hour to thirty days, with the shortest window winning across a person’s roles.
- New offline work refused once the window lapses, and queued work held until the phone reconnects and refreshes the policy.
- A workspace offline policy limiting which of eight groups of work may be done offline, the oldest queued work accepted, the queue size, GPS accuracy and the re-sign-in interval.
- Server-side refusals on replay for work of a disallowed kind and for work queued too long, the second reviewable by someone who manages device trust.
- Five events that end an offline session: password change, role change, device locked or revoked, suspension and offline too long.
- A device id per install, used for device trust, revocation and scanner-link binding.
More we can add to your workspace
- Setting the offline policy from the mobile app, as well as on the web.
- A trust window per warehouse or site, for organizations whose risk is about the place rather than the role.
- A list of devices close to the end of their window, so a supervisor can ask someone to connect before work stops.
Where we point you to a specialist
- We will not let a phone keep queuing work after its trust window has lapsed. A field team that needs longer gets a longer window, set by someone who manages device trust.
The near-the-window list is the extension field teams ask for first, because every device’s last contact with the server is already recorded.
Offline rules that match how your teams travel
The trust window, the workspace policy and the server-side refusals are in place. Three extensions come up most often.
The policy from the app
A device-trust manager changing the offline limits from a phone, not only from the web.
A window per site
Longer for the outpost with no signal, shorter for the head-office store.
Devices nearing their window
A list and a reminder before a field officer’s phone stops accepting work.
Three questions for any offline app
If we suspend someone, how long can their phone keep working offline?
What you will probably hear
Until it next connects.
How to read it
That could be weeks. Ask whether you can set an upper limit.
Can we stop approvals being done offline but allow stock counts?
What you will probably hear
Offline is on or off.
How to read it
Then the riskiest work is allowed wherever the easiest is.
What happens to a sale queued five days ago when it finally arrives?
What you will probably hear
It is accepted.
How to read it
Prices, stock and approvals may have changed. Old work should be checked before it is posted.
The short version
Let field teams work offline, and decide in writing how long a phone may trust what it last heard and what it may do in that time. Give each role a trust window, limit offline work to the kinds you are comfortable with, and let the server refuse anything too old or of the wrong kind when it finally arrives.
See mobile offline operations
What the app does without a connection, how the queue drains, and the device and offline controls around it.
Explore offline operationsFrequently asked questions
What is the offline trust window?
How long a phone may keep working offline on the security policy it last fetched from the server. It is set per role, from one hour to thirty days, and every successful fetch resets the clock.
What happens when the window runs out?
The app stops accepting new offline work and holds what is already queued. As soon as it reconnects and fetches the policy again, the window resets and the queue drains.
Someone has two roles with different windows. Which applies?
The shorter one. Per-role device rules are combined strictest-wins.
Can we stop certain work being done offline?
Yes. The workspace offline policy can limit offline work to chosen groups, such as stock counts and transfers but not approvals. Work of a disallowed kind is refused when it reaches the server and has to be redone while connected.
What ends an offline session immediately?
A password change or reset, a change of roles, a device locked or revoked, a suspended account, or a phone offline longer than the re-sign-in limit. The phone is signed out on its next call to the server.
