Institution creates request → customer clicks "Connect with PassID" → PassID owns the entire auth & consent experience → institution receives connection_id.