The GRIDS flow:

User initiates action on connected device (computer, merchant terminal, phone browser)

Connected device creates a GRIDS instruction and encodes it as a QR code (for mobile) or a unique GRIDS URL (for desktop applications)

User scans the QR code with their wallet (for mobile or an air-gapped signing device), or the wallet opens the GRIDS URL directly (for desktop applications)

Wallet decodes the instruction, displays what will be signed, and awaits user approval

User approves; wallet signs the instruction cryptographically

Return path: For mobile or air-gapped devices, the signed response is displayed as a QR code on the wallet and scanned by the connected device. For desktop applications, the signed response is returned directly through the GRIDS URL channel.

At no point does the private key exist on any network-connected device.

GRIDS is not limited to payments. The protocol handles the full range of on-chain interactions: signature and submission of pre-defined smart contract call data (enabling interaction with any application on any chain), spend transaction initiation (direct payments), and message signature for authentication (proving identity without sharing private data). Critically, GRIDS works across Groot and any Associate Chain. A single signing device, one set of keys, one air-gapped protocol, serves the entire Gajumaru system regardless of which chain the interaction targets.

The user experience is modelled on established patterns that hundreds of millions of people already understand. Scandinavian BankID works in exactly the same way: the service displays a QR code, you scan it with your phone, enter a PIN or press a biometric, and you are authenticated. GRIDS delivers the same ease of use, with a critical difference: there is no institution in the middle that can revoke your identity, observe your activity, or be compromised in a way that exposes your data. There is no third party that even knows the authentication occurred.

r/Gajumaru 

More here: https://gajumaru.io/unwhite-paper/

No Account. No Password. No Database to Hack. This Is How Authentication Should Work.