Closed-loop authentication