At sites running the external HR directory the self-hosted table is empty, so every kiosk badge fell to the deny policy. The resolver now branches on employee_directory_mode: selfhosted reads the directory table by SSO; external queries the HR directory, resolving PayNo badges by their real PayNo column.