diff --git a/biometrics/face/1.0/IBiometricsFace.hal b/biometrics/face/1.0/IBiometricsFace.hal
index ee67497..e3c256a 100644
--- a/biometrics/face/1.0/IBiometricsFace.hal
+++ b/biometrics/face/1.0/IBiometricsFace.hal
@@ -240,4 +240,13 @@
      * @return status The status of this method call.
      */
     userActivity() generates (Status status);
+
+    /**
+     * Reset lockout for the current user.
+     *
+     * @param hat A valid Hardware Authentication Token, generated when the
+     *     user authenticates with Pin/Pattern/Pass.
+     * @return true if lockout was reset, false otherwise.
+     */
+    resetLockout(vec<uint8_t> hat) generates (bool success);
 };
diff --git a/biometrics/face/1.0/types.hal b/biometrics/face/1.0/types.hal
index 1ec5b74..a488d67 100644
--- a/biometrics/face/1.0/types.hal
+++ b/biometrics/face/1.0/types.hal
@@ -121,13 +121,21 @@
 
     /**
      * Face authentication is locked out due to too many unsuccessful attempts.
+     * This is a "soft" lockout, and authentication can be restarted after
+     * a period of time, generally on the order of 30 seconds.
      */
     LOCKOUT = 7,
 
     /**
      * Used to enable a vendor-specific error message.
      */
-    VENDOR = 8
+    VENDOR = 8,
+
+    /**
+     * Face authentication is disabled until the user unlocks with strong
+     * authentication (PIN/Pattern/Password).
+     */
+    LOCKOUT_PERMANENT = 9
 };
 
 /**