Indoor Positioning as Credentialed Infrastructure Network

Domain Context

Indoor positioning standards have matured into a coherent set of complementary specifications. 3GPP TS 38.305 defines the NR positioning architecture, including downlink time-difference-of-arrival (DL-TDoA), uplink time-difference-of-arrival (UL-TDoA), multi-cell round-trip time, and downlink angle-of-departure procedures, executed across the Location Management Function and the gNodeB. IEEE 802.11mc and the subsequent 802.11az amendment specify Fine Timing Measurement (FTM), giving Wi-Fi access points a sub-meter ranging capability that smartphones already implement. Bluetooth 5.1 introduced direction-finding extensions for angle-of-arrival (AoA) and angle-of-departure (AoD), which BLE-beacon vendors have adopted across hospital asset-tracking and retail-analytics deployments. IEEE 802.15.4z added enhanced UWB physical layers (HRP and LRP) with cryptographic timestamp protections that the FiRa Consortium and Apple, Google, and Samsung have shipped in handset and tag products.

The deployment reality lags the standards. A modern hospital runs RTLS for asset tracking under one vendor, BLE wayfinding under a second, Wi-Fi RTLS for staff-duress under a third, and a UWB-based contact-tracing pilot under a fourth, each with its own anchor placement, its own credentialing model, and its own back-end. An airport adds passenger-flow analytics, security-zone access control, and baggage-handling RFID on top of an FAA-regulated airside positioning regime. A mixed-use building layers facility-operator positioning, tenant-specific positioning for medical or financial tenants, and public-safety positioning for fire-department pre-incident planning under NFPA 915 and Section 916 of the NDAA-driven first-responder location requirements. Every layer is real, every layer is regulated differently, and every layer currently runs as its own silo.

Architectural Requirement

The architectural requirement is credentialed marker infrastructure that admits multi-class composition. A position fix in a hospital corridor must carry the facility-operator's credentialing for the corridor itself, the tenant credentialing if the tenant occupies an adjacent suite, the regulatory credentialing if the corridor abuts a controlled-substance storage zone, and the public-safety credentialing that a fire-department pre-plan can rely on during an incident. The same marker (a UWB anchor, a BLE beacon, an FTM-capable access point, a passive RFID tag) must be referenceable under each of those classes without forcing the venue to deploy four parallel infrastructures.

Three properties drive the architecture. First, marker provenance must be portable: a marker installed today by a contractor, certified by the facility operator, and consumed by a third-party application must carry an unambiguous, verifiable origin record that survives vendor change. Second, regulated routing must compose with general access: a controlled-substance zone's positioning records must satisfy DEA Form 222 audit chains while the same anchors serve general wayfinding. Third, multi-class fusion must be declared rather than coincidental: when a smartphone fuses a UWB range, a BLE AoA, and an FTM measurement, the resulting fix must reference each contributing marker class explicitly so that downstream consumers can re-derive what was measured by what.

Why Procedural Compliance Fails

The procedural status quo treats indoor positioning as a vendor-deliverable. The facility issues an RFP, picks a platform, and accepts the vendor's credentialing model along with the hardware. The approach has three structural failure modes that show up the moment the facility tries to do anything beyond the vendor's reference architecture.

Vendor lock-in is the visible failure. Markers from vendor A do not interoperate with the back-end of vendor B; a vendor change forces re-survey, re-installation, and re-certification of every fixture, which is why ten-year-old BLE deployments are still in service well past their battery-replacement economics. Cross-facility standardization is the invisible failure: a hospital system with twenty campuses cannot share a positioning specification across campuses because each campus's vendor contract scopes the credentialing model to that campus.

Maintenance burden compounds the lock-in. BLE beacons drift in transmit power, UWB anchors require periodic time-base recalibration, and FTM-capable access points get firmware-updated on the network team's schedule rather than the positioning team's. Procedural maintenance (manual surveys, vendor-dispatched recalibration, scheduled audits) does not produce an audit-grade record of marker state at any given moment, which means that when a positioning record is challenged (a controlled-substance discrepancy, a slip-and-fall liability case, an evacuation post-mortem), there is no recoverable lineage from the fix back to the anchors that produced it.

Cross-facility standardization fails for the same reason. Each site reinvents the credentialing model, which makes hospital systems, airport authorities, and multi-tenant landlords unable to operate a coherent positioning posture across their portfolio. The procedural fix is a corporate-standards document; the structural fact is that the standards document does not flow into the positioning data because the positioning data has no field for it.

What the AQ Primitive Provides

The marker-track primitive treats every fixed emitter as a credentialed marker and every position fix as a credentialed event whose lineage references the contributing markers. A UWB anchor enters the architecture with an installation event credentialed by the installing contractor, a certification event credentialed by the facility operator, and (where applicable) a regulatory event credentialed by the relevant authority. The marker is identifiable as the same marker across vendor changes, because the credentialing chain is in the architecture rather than in the vendor's database.

Multi-class marker fusion is the declared composition over those credentialed markers. A smartphone in a hospital corridor that performs a 5G NR DL-TDoA measurement against gNodeBs, an 802.11az FTM measurement against access points, a BLE 5.1 AoA measurement against beacons, and a UWB ranging exchange against FiRa anchors produces a fused fix whose lineage cites each contributing marker class explicitly. The fusion is declarative: the venue specifies which marker classes are admissible for which zone, which combinations are acceptable for which use cases (general wayfinding, asset tracking, controlled-substance audit, emergency egress), and the architecture either produces a fix that satisfies the declaration or it produces a candidate that names which classes are missing.

Regulated-credentialed routing falls out of the same mechanism. A controlled-substance zone is a declared zone whose admissible markers carry the regulatory credentialing class; a position fix inside that zone is a credentialed event whose lineage references the regulated markers. DEA, Joint Commission, and FDA-track-and-trace audits consume the lineage directly, without the facility having to maintain a parallel audit log, because the audit log is the credentialed-event stream.

Compliance Mapping

The architecture maps to existing regulatory regimes by composition rather than by replacement. HIPAA-relevant location records inside a hospital (where a patient is, who is accessing a medication room, when a controlled-substance cabinet was opened) are credentialed events whose lineage already encodes the marker classes and the access credentials of the reading device, satisfying access-log and audit-trail requirements as a side effect. Joint Commission Environment of Care standards on asset tracking, life-safety routing, and emergency egress consume the same credentialed-event stream that drives day-to-day operations.

FCC Part 15 governs the radio side of BLE, UWB, and Wi-Fi emitters, and FCC E911 Phase II / Z-axis requirements drive the public-safety dispatchable-location obligation; the architecture's credentialed-marker model lets a venue contribute dispatchable-location fixes to public-safety answering points with an audit chain that survives a 911-recording subpoena. Section 215(g) of the FAA Reauthorization Act and FAA Order 8200.1 govern airside positioning at airports; venue-credentialed markers admit FAA-credentialed routing for the airside zones while serving the same passenger flow with general credentialing on the landside. NFPA 915 fire-safety positioning, ADA wayfinding obligations, and the various state-level controlled-substance regimes compose into the same primitive without requiring separate infrastructures.

Adoption Pathway

Adoption begins with a single facility and a single regulated zone. A hospital pilots credentialed-marker infrastructure for its controlled-substance corridors, leaving the rest of the building under existing vendor systems; the pilot proves the audit-grade lineage and the cross-vendor portability. From there the facility extends to mixed-tenant zones, then to general wayfinding, then to cross-campus standardization across the hospital system. The same pathway works at airports (airside-first, then landside), at multi-tenant office buildings (regulated-tenant-first, then general), and at industrial facilities (safety-zone-first, then operational).

Cross-vendor portability is the leverage point. Once a venue's credentialing model is in the architecture rather than in a vendor's database, vendor competition shifts to anchor quality, beacon battery life, FTM firmware, and back-end analytics, rather than to credentialing-model lock-in. Smart-building services, integrated emergency response, ambient-intelligence applications, and the next generation of indoor positioning specifications (3GPP Release 18 sidelink positioning, 802.11bf sensing, FiRa 2.0) enter through the same credentialed-marker interface that already admits today's UWB and BLE deployments. The architecture admits the evolution by declaration, which is the property that lets venue operators commit to indoor positioning as long-lived infrastructure rather than as a recurring re-procurement.

The credentialed-marker primitive on which this adoption pathway rests is disclosed in U.S. Provisional Application No. 64/049,409, which specifies the marker, the credential binding, and the zone-policy interface as architectural elements rather than as vendor features. The provisional fixes the separation between physical anchor, credential carrier, and policy authority such that a hospital, an airport, or an industrial operator can swap any one element without disturbing the other two. That separation is the structural property that lets venue operators treat credentialed indoor positioning as durable infrastructure on the timescale of building systems, rather than as application software refreshed at each procurement cycle.