Passkey Authentication Service  ·  View 06 of 21  ·  People and journeys

Journey — Turning Off the Password

The journey where the platform refuses the thing the administrator came to do.

Editable source SVG draw.io All views
Tenant administrator 2.1 M end users Goal — Make the phishing-resistance claim actually true Trigger — Asked at a board review whether passwords are gone Done when — Legacy path removed, support queue flat 1 · Measures 2 · Nudges 3 · Gated ◆ moment of truth 4 · Cuts over ◆ moment of truth 5 · Holds What they do Reads coverage Turns on the offer Requests passkey-only Sets the cutover date Watches recovery volume What the platform does Three coverage figures Records accept or decline Refuses below threshold Logs it as irreversible Reports recovery cost How it feels Confident Fine Exposed Where it hurts Declines outnumber accepts Two-or-more coverage is 41% No undo once removed What answers it The decision rests on data Override is explicit and attributed Recovery cost is a reported line Journey — The Tenant Administrator Turns Off the Password The trough is the platform refusing the thing the administrator came to do, which is the point: a cutover at 41% coverage is a support incident wearing a security announcement. v 1.0 · owner Security & Identity Architecture · date 2026-10

The finding

  • The trough is the gate: at 41% two-or-more-credential coverage, a passkey-only cutover is a support incident wearing a security announcement, and the platform says so before it happens.
  • The override exists, is explicit, and is attributed. A platform that cannot be overridden gets worked around; one that records who overrode it gets argued with instead.
  • Removing the legacy path is logged as irreversible, because a tenant that can quietly switch the password back on has not actually made the phishing-resistance claim true.

What the set answers it with

  • Three coverage figures per tenant — any credential, two or more, still legacy-dependent (view 18).
  • The impact-analysis gate in the release pipeline, which counts the users a policy change would lock out (view 17, ADR-11).
  • Recovery-path cost reported as its own line, since that is where the cutover's real cost lands (ADR-13).

Assumptions

  • 2.1 million end users for the illustrated tenant; 41% holding two or more credentials at the point of the request.
  • A cutover threshold is tenant-set rather than platform-set, because the acceptable lockout rate is a business decision.
◀  Journey — The User Who Has Lost Every Device All views Layered Architecture  ▶
Solution Architecture v1.0 · open source, self-hosted on Kubernetes · Security & Identity Architecture · 2026-1006-journey-cutover