The base I think works like this:
- you scan the passport
- you look at the camera
- your passport details & photo are sent to the control room with your live feed
- a guy looks at everything those details plus your immigration history and other info
- same guy decides to let you in or send you to a desk
This was particularly obvious in the old Gibraltar border where you could easily be the only person going through and so the agent had to do the routine just to let you pass.
I do wonder how much is automated. For example, is the gate fully automated in calculating a risk score and then referring you to a border agent if above a threshold? Is a person looking at the details in realtime to decide that, or are they just doing facial recognition, or are they only involved when the gates fail.
I wonder if you're failing due to not recognising your face, or (no offence intended) that you have too high a risk profile in some way due to your passport info, and they decide they want to see you in person.
Passports don't know the current time and thus can't tell whether the presented certificate is within its validity range (as in a malicious attacker could feed an expired certificate as well as a fake "current time" value to make it appear valid), so why are those certificates short-lived?
It's not perfect but if you started you trip in another country with such a system and where a more recent certificate was used, your passport will deny access.
It might be doing facial recognition, but it feels too reliable for the level of facial recognition I expect a consultancy could pull off in a government contract.