I thought you need to prove you are working in cybersecurity or provide evidence of authorization for work done.

It's really just simple ID/face verification?

For OpenAI's Cyber verification (the normal kind for Codex) you absolutely do not need any proof of cybersecurity work/authorization. They just use Persona for KYC + live selfie, and some extra checks that I don't know the nature of (but not related to checking whether you're a cybersecurity professional).