Passkey Authentication Service  ·  View 05 of 21  ·  People and journeys

Journey — The User Who Has Lost Every Device

The journey that starts in the trough, and the only one where the architecture has to climb.

Editable source SVG draw.io All views
Everyday user no working credential Goal — Get back into the account today Trigger — New phone; the old one is gone Done when — Signed in, with a new passkey enrolled 1 · Locked out ◆ moment of truth 2 · Picks a route 3 · Proves it ◆ moment of truth 4 · Waits 5 · Back in What they do Tries to sign in Chooses what they still have Follows the link, or calls Waits out the window Enrols a new passkey What the platform does No credential found Offers configured routes only Rate-limits per handle Holds revocation rights Requires a credential to finish How it feels Relieved Fine Stranded Where it hurts There is no password to reset The tenant configured only email Cannot evict the lost device yet What answers it Assurance level rides the verdict Cross-account bursts are an abuse signal Takeover cannot evict the owner Recovery that leaves no credential is incomplete Journey — The User Who Has Lost Every Device This journey starts in the trough. The architecture's job is the climb, and the only thing that makes the climb safe is that the route's weakness is carried into the verdict rather than forgotten. v 1.0 · owner Security & Identity Architecture · date 2026-10

The finding

  • There is no password to reset, so recovery is not a fallback path bolted onto authentication — it is the account's real assurance ceiling, and it is set by whichever route the tenant configured.
  • The cooling-off window is the uncomfortable part: the legitimate owner cannot immediately evict their lost device. That cost is accepted because the same window stops a takeover evicting them.
  • A recovery that ends with a session but no credential is counted as incomplete, which turns "get them in" into "get them working".

What the set answers it with

  • Assurance classification carried into the verdict, so a tenant can forbid high-value actions from a low-assurance recovery (view 15, ADR-07).
  • Cross-account recovery bursts treated as a platform abuse signal rather than per-user rate limiting alone.
  • Mandatory credential enrolment before the recovery is closed.

Risks

  • A tenant configuring only an email channel reintroduces exactly the phishing surface passkeys removed, and the platform can report that but not prevent it.
  • 95% of legitimate recovery attempts completing within 10 minutes is an assumption; the assisted route will not meet it and is excluded from that measure.
◀  Journey — Enrolling a First Passkey All views Journey — Turning Off the Password  ▶
Solution Architecture v1.0 · open source, self-hosted on Kubernetes · Security & Identity Architecture · 2026-1005-journey-recover