Passkey Authentication Service  ·  View 17 of 21  ·  Operations

Code and Policy Release Pipeline

One pipeline for both, and the gate that counts the users a change would lock out.

Editable source SVG draw.io All views
Source Git repository services and policy Build Container image digest-addressed SBOM and signature Gate Unit and fuzz WebAuthn test vectors conformance suite Policy impact analysis who gets locked out Staging Tenant staging RP IDs isolated credentials Canary One region, 5% ceremony outcome watch Production Argo CD sync all regions Policy version live new ceremonies only refused: 14 k would lock out outcome rate flat Passkey Authentication Service — Code and Policy Release Pipeline Data store Application we own Security / platform Decision point failure / alternate synchronous A policy change travels the same pipeline as code, and the gate that can stop it is the one that counts the users it would lock out. v 1.0 · owner Security & Identity Architecture · date 2026-10

Decisions

  • A tenant policy change travels the same pipeline as code, because both can lock a user out and only one of them currently gets reviewed.
  • The impact-analysis gate is a hard refusal, not a warning: a change that would lock out users above a threshold does not reach staging without an attributed override.
  • Policy versions apply to new ceremonies only. Nothing in this pipeline can retroactively invalidate a credential; that requires a separate, two-approver revocation.
  • The WebAuthn conformance vectors run on every build, because a verification regression is silent — it accepts rather than fails.

Assumptions

  • Canary is one region at 5% of ceremonies, watched on ceremony outcome rate rather than on error rate alone.
  • Staging tenants have their own RP IDs and credential population; a staging credential cannot authenticate against production.
  • Images are digest-addressed and signed, with admission policy refusing anything unsigned.

Risks

  • A canary measured only on errors would miss the worst regression this platform can have: a verifier that accepts something it should refuse. Outcome-rate watching catches the shape of it, not the fact of it.
◀  Deployment Topology All views Observability Matrix  ▶
Solution Architecture v1.0 · open source, self-hosted on Kubernetes · Security & Identity Architecture · 2026-1017-release-pipeline