Passkey Authentication Service · View 19 of 21 · Operations
Decisions
- A metadata compromise notice raises affected credentials for a decision; it never revokes them automatically, because an upstream publication would otherwise be able to log out a tenant's entire user base.
- Revocation is a state change and the record stays, which is what lets the audit trail outlive the credential.
- The loop closes through Replaced. A revocation that leaves a user with no credential is an unfinished lifecycle, and the recovery flow exists to finish it.
- Observation is continuous and advisory: counter movement, risk signals and last-used time accumulate on the credential without gating it.
Assumptions
- Re-evaluation runs as a batch job against stored verdicts, not on the authentication path.
- Bulk revocation by authenticator model or policy version requires a second approver and reports the affected user count before executing.
Risks
- "Raised for a decision" needs someone to decide. An unattended queue of raised credentials is the realistic failure of this loop, which is why the count is a reported signal and not just a work list.
