Passkey Authentication Service · View 08 of 21 · Structure
Decisions
- Verification replicas are stateless and disposable; the only affinity in the system is the region pin, not a session.
- The ceremony store and the tenant config cache sit inside the region-pinned boundary because both are reconstructible — one by the user retrying, the other by an asynchronous refresh.
- Revocation is a service with a two-approver control, not a database update, because bulk revocation is the most destructive capability in the platform.
- The HSM is reachable only from the custody boundary and signs only; no key material is ever exported, including to a backup.
Assumptions
- 24 assertion-verifier replicas and 12 challenge-issuer replicas per region at steady state; the ratio follows the two-call ceremony with a cheaper first call.
- Credential store 480 GB across 400 million records at roughly 1.2 KB each.
- Metadata ingest runs daily as a signature-checked job, not continuously.
What this view omits
- Every service's read of the config cache and write to the audit stream.
- The recovery orchestrator's enrolment write into the credential store, which view 15 shows in its proper sequence.
