Passkey Authentication Service  ·  View 12 of 21  ·  Data

Data Model

Nine entities, and the one that is immutable on purpose.

Editable source SVG draw.io All views
tenant tenant_id PK name residency_region_set migration_mode legacy_removed_at rp_id rp_id PK tenant_id FK -> tenant domain_verified_at origin_allowlist policy_version policy_version_id PK tenant_id FK -> tenant user_verification attestation_mode counter_mode effective_from user_handle user_handle PK opaque tenant_id FK -> tenant rp_subject unique per tenant created_at credential credential_id PK user_handle FK -> user_handle public_key cose_alg sign_counter backup_eligible label state active|revoked last_used_at admission_verdict credential_id PK FK -> credential aaguid attestation_result policy_version_id FK snapshot_age_s immutable ceremony ceremony_id PK tenant_id user_handle nullable challenge policy_version_id expires_at consumed bool recovery_attempt attempt_id PK user_handle FK -> user_handle method assurance_level operator_id nullable outcome enrolled_credential_id FK audit_event event_id PK tenant_id user_handle pseudonymous credential_id nullable kind verdict prev_hash occurred_at 1 : N 1 : N 1 : N 1 : N 1 : N 1 : N 1 : 1 1 : N Passkey Authentication Service — Data Model A credential's admission verdict is a separate, immutable row on purpose: the authentication path reads it and nothing rewrites it. v 1.0 · owner Security & Identity Architecture · date 2026-10

Decisions

  • The admission verdict is a separate one-to-one row rather than columns on the credential, so that "what we decided at registration" cannot be edited by code that updates "how the credential is doing".
  • The user handle is the primary key users are known by, and it carries no personal data — the relying party's own subject is a per-tenant unique column, not the identity.
  • A ceremony references the policy version in force when it began, so a policy change mid-ceremony cannot alter the rules the user is being held to.
  • A recovery attempt records its method, its assurance level, the operator where there was one, and the credential it ended up enrolling. A recovery with no enrolled credential is visibly incomplete in the data.

Assumptions

  • Credential state is active or revoked, with no deleted state: revocation never removes the row.
  • Audit events carry a previous-hash column, making the chain verifiable without a separate ledger.
  • backup_eligible is stored because a synced credential and a device-bound one behave differently under the counter policy, and the support desk needs to know which it is looking at.

What this view omits

  • Tenant-level billing and contract data, which is not this platform's concern.
  • Risk velocity counters, which are not relational and live in the ephemeral zone.
◀  Storage Zones by Rebuildability All views Critical Flow — One Authentication Ceremony  ▶
Solution Architecture v1.0 · open source, self-hosted on Kubernetes · Security & Identity Architecture · 2026-1012-data-model