Passkey Authentication Service · View 10 of 21 · Data
Decisions
- The verifier reads the credential store and never writes it on the authentication path, apart from the asynchronous counter observation.
- Only an opaque user handle crosses into the evidence stream, so the audit trail survives an erasure request without being deleted.
- Coverage marts are derived nightly rather than computed live, because a migration decision is a weekly decision and not a dashboard refresh.
- Everything downstream of the stream is rebuildable from it, which is what bounds the backup scope in view 11.
Assumptions
- 2.5 billion authentication events per year; 13 months queryable, 7 years archived.
- Audit stream RPO 5 seconds, achieved by buffering rather than by synchronous writes.
- Erasure deletes credential records and the handle mapping, leaving events under a pseudonymous handle.
Risks
- A pseudonymous handle retained for 7 years is still a re-identification surface if the mapping is ever recovered from a backup; mapping backups therefore share the credential store's deletion schedule.
