Passkey Authentication Service  ·  View 20 of 21  ·  Assurance

Trust Zones and Segmentation

Six zones ordered by exposure, and the property the ordering exists to preserve.

Editable source SVG draw.io All views
Internet User device WebAuthn client Authenticator holds the private key Perimeter Ceremony gateway TLS, origin allowlist Limit and shed Ceremony zone — holds no durable secret Verification pods stateless Ceremony store TTL 300 s Data zone Credential store public keys only Handle directory opaque handles Custody zone Vault Network HSM keys never leave Evidence zone Audit stream MinIO archive write-once TLS 1.3 only mTLS, Linkerd tenant-scoped SQL sign only append only Passkey Authentication Service — Trust Zones and Segmentation External / third party Interface / broker Application we own Data store Security / platform Queue / topic synchronous event / async A full dump of the data zone authenticates nobody. That is the property the segmentation exists to preserve, and the reason the custody zone is small. v 1.0 · owner Security & Identity Architecture · date 2026-10

Decisions

  • A full dump of the data zone authenticates nobody. The platform holds public keys and verification material only, which is the single strongest security property in the design and the reason the custody zone can stay small.
  • The ceremony zone holds no durable secret, so its blast radius is one five-minute window of in-flight logins.
  • The custody zone signs and never exports. There is no key backup, because a key that can be restored is a key that can be stolen from a restore.
  • Origin and RP ID are checked at the perimeter and re-checked against the tenant allowlist server-side, regardless of what the request's own headers claim.

Failure handling

  • Credential store unreachable: fail closed. The platform does not authenticate from cache.
  • Metadata service unreachable: fail static on the last signed snapshot, with the staleness recorded on any verdict it admits.
  • Risk engine unreachable: fail open, verdict marked unevaluated.
  • Ceremony store partition: in-flight ceremonies fail closed with a distinct restart-the-ceremony error rather than a generic failure.

Accepted residual risk

  • A compromised verification replica can issue challenges and read credential public keys for its tenant's traffic; it cannot forge an assertion or sign a verdict without the HSM.
  • A tenant whose only recovery route is an out-of-band channel has an account assurance ceiling set by that channel, and no zone boundary changes that.
◀  The Credential Lifecycle Loop All views Identity Flow — From Verdict to the Tenant's Own Session  ▶
Solution Architecture v1.0 · open source, self-hosted on Kubernetes · Security & Identity Architecture · 2026-1020-security-zones