The everyday user's goal contains the whole problem: convenience plus a credible answer to losing the device. The second half is where passwordless designs fail.
The support agent's goal is the one most often left out — proving a caller's identity without the support desk quietly becoming the account's strongest authenticator.
The authenticator is in the cast because its goal (never hand over the private key) is a constraint on the platform, not a feature of it.
The metadata ingest job appears as an actor because its goal is to refuse, and a job whose job is to refuse needs an owner.
Assumptions
320 support seats across the tenant estate; assisted recovery is a minority route but the most expensive per case.
Average 2.3 credentials per user, which means a large minority still hold exactly one.
40 relying-party backends integrated, each issuing its own sessions.
Risks
A tenant that treats the support desk as its primary recovery route caps every account's assurance at whatever an agent can verify over a phone.
The multi-device user is the easy case and tends to dominate design reviews; the single-credential user is the one who generates the incidents.
