Passkey Authentication Service · View 21 of 21 · Assurance
Decisions
- The platform returns a signed, short-lived, single-use verdict. It never issues a session, and there is no message in this flow where it could.
- The verdict carries the credential used, the user-verification state, the assurance level of the path taken, and the risk signals that applied — everything a relying party needs to make its own step-up decision.
- Verification is offline against cached material, so a platform outage does not prevent a relying party validating a verdict it already holds.
- Logout, session lifetime, revocation and step-up stay with the relying party, which is what bounds the consequence of a compromise of this platform.
Assumptions
- Verdict TTL 60 seconds, single use, audience-bound to one RP ID.
- Verification material cached by relying parties for up to an hour, which bounds key-rotation effect.
- Platform administrators authenticate through this same flow against the platform's own RP ID — it is its own first relying party.
Risks
- A relying party that does not check the nonce, the audience or the assurance level turns a correct verdict into a replayable token. The SDK does it; the contract says it; nothing in the platform can enforce it.
