[ { "id": "01-system-context", "title": "Passkey Authentication Service — System Context", "layout": "context", "system": { "label": "Passkey Authentication Service", "sub": "WebAuthn, multi-tenant" }, "colWidth": 265, "groups": [ { "side": "left", "title": "People", "nodes": [ { "id": "enduser", "label": "End user", "kind": "actor", "sub": "180 M accounts", "rel": "enrols, signs in, recovers", "dir": "in" }, { "id": "agent", "label": "Support agent", "kind": "actor", "sub": "tenant staff", "rel": "assisted recovery", "dir": "in" }, { "id": "tadmin", "label": "Tenant administrator", "kind": "actor", "rel": "policy", "dir": "in" } ] }, { "side": "right", "title": "Relying parties", "nodes": [ { "id": "rpfront", "label": "Relying-party app", "kind": "external", "sub": "web and mobile", "rel": "runs the ceremony", "dir": "in" }, { "id": "rpback", "label": "Relying-party backend", "kind": "external", "sub": "40 tenants", "rel": "signed verdict", "kind2": "sync" }, { "id": "rpsession", "label": "Relying-party sessions", "kind": "external", "sub": "issued by the tenant" } ] }, { "side": "top", "title": "Trust inputs", "nodes": [ { "id": "authn", "label": "Authenticator", "kind": "external", "sub": "platform or roaming", "rel": "attestation, assertion", "dir": "in" }, { "id": "mds", "label": "FIDO Metadata Service", "kind": "external", "sub": "signed BLOB", "rel": "daily snapshot", "dir": "in", "kind2": "batch" } ] }, { "side": "bottom", "title": "Downstream, and deliberately refused", "nodes": [ { "id": "noauthz", "label": "Authorization and entitlements", "kind": "risk", "sub": "the tenant's job" }, { "id": "nopwd", "label": "Password storage", "kind": "risk", "sub": "stays with the tenant" }, { "id": "siem", "label": "Tenant SIEM", "kind": "external", "sub": "audit export" }, { "id": "oob", "label": "Out-of-band channel", "kind": "external", "sub": "tenant's provider", "rel": "recovery message", "kind2": "async" } ] } ], "note": "Audit export and the tenant's own session issuance are shown without arrows: both are the tenant's pull, not this platform's push.", "meta": { "v": "1.0", "owner": "Security & Identity Architecture", "date": "2026-10" } }, { "id": "02-high-level", "title": "Passkey Authentication Service — High-Level Architecture", "layout": "flow", "chain": true, "align": "middle", "nodeWidth": 190, "stages": [ { "title": "Client", "nodes": [ { "id": "client", "label": "WebAuthn client", "kind": "external", "sub": "browser or app" }, { "id": "auth", "label": "Authenticator", "kind": "external", "sub": "holds the private key" } ] }, { "title": "Edge", "nodes": [ { "id": "gw", "label": "Ceremony gateway", "kind": "integration", "sub": "Envoy, TLS, origin check" }, { "id": "shed", "label": "Limit and shed", "kind": "integration", "sub": "challenges first" } ] }, { "title": "Ceremony plane", "nodes": [ { "id": "issue", "label": "Challenge issuer", "kind": "app", "sub": "16 bytes, single use" }, { "id": "verify", "label": "Assertion verifier", "kind": "app", "sub": "p99 60 ms" }, { "id": "attest", "label": "Attestation verifier", "kind": "app", "sub": "registration only" } ] }, { "title": "Hot-path state", "nodes": [ { "id": "cstore", "label": "Ceremony store", "kind": "store", "sub": "Redis, region-pinned" }, { "id": "cred", "label": "Credential store", "kind": "store", "sub": "CockroachDB, replicated" } ] }, { "title": "Verdict", "nodes": [ { "id": "signer", "label": "Verdict signer", "kind": "security", "sub": "Vault, PKCS#11 HSM" }, { "id": "risk", "label": "Risk engine", "kind": "platform", "sub": "fails open" } ] }, { "title": "Warm and cold planes", "nodes": [ { "id": "life", "label": "Lifecycle and recovery", "kind": "app", "sub": "devices, revocation" }, { "id": "ctrl", "label": "Control plane", "kind": "platform", "sub": "tenants, policy, MDS" } ] }, { "title": "Evidence", "nodes": [ { "id": "bus", "label": "Audit stream", "kind": "queue", "sub": "Kafka, buffered" }, { "id": "audit", "label": "Audit store", "kind": "store", "sub": "ClickHouse, MinIO" } ] } ], "edges": [ { "from": "verify", "to": "bus", "label": "outcome", "kind": "async" }, { "from": "ctrl", "to": "cred", "label": "revocations", "kind": "batch", "route": "gutter" } ], "note": "The hot path reads the credential store and mutates the ceremony store. Everything else is a cache, a snapshot or an asynchronous pipeline.", "meta": { "v": "1.0", "owner": "Security & Identity Architecture", "date": "2026-10" } }, { "id": "03-actors-and-journeys", "title": "Passkey Authentication Service — Actors and Their Core Journeys", "layout": "actors", "groups": [ { "title": "The people signing in", "kind": "boundary", "actors": [ { "id": "everyday", "label": "Everyday user", "sub": "180 M accounts", "goal": "Sign in on my phone without remembering anything, and still get back in when I drop it in a lake.", "journeys": [ { "id": "j-enrol", "label": "Enrol a first passkey", "sub": "after a password login" }, { "id": "j-signin", "label": "Sign in on a new device" }, { "id": "j-recover", "label": "Get back in with no devices", "sub": "the expensive one" } ] }, { "id": "multi", "label": "Multi-device user", "sub": "2.3 credentials average", "goal": "Add my work laptop's security key without being asked to set everything up again.", "journeys": [ { "id": "j-add", "label": "Add a second credential" }, { "id": "j-revoke", "label": "Revoke a lost device" } ] } ] }, { "title": "The people who run a tenant", "kind": "onprem", "actors": [ { "id": "tadmin", "label": "Tenant administrator", "sub": "40 tenants", "goal": "Turn the password off without my support queue exploding on Monday morning.", "journeys": [ { "id": "j-cutover", "label": "Turn off the password" }, { "id": "j-policy", "label": "Change an authentication policy" } ] }, { "id": "agent", "label": "Support agent", "sub": "320 seats", "goal": "Prove this caller is who they say they are without becoming the account's real authenticator.", "journeys": [ { "id": "j-assist", "label": "Run an assisted recovery" } ] }, { "id": "sre", "label": "On-call engineer", "sub": "1 primary, 1 secondary", "goal": "Tell a ceremony-store blip apart from a tenant that mistyped its origin, before the pager escalates.", "journeys": [ { "id": "j-triage", "label": "Triage a login incident" } ] } ] }, { "title": "Machines and standards", "kind": "cloud", "actors": [ { "id": "rp", "label": "Relying-party backend", "kind": "external", "sub": "40 integrated", "goal": "Hand me a verdict I can verify offline, and let me keep issuing my own sessions.", "journeys": [ { "id": "j-verdict", "label": "Exchange a verdict for a session" } ] }, { "id": "mdsjob", "label": "Metadata ingest job", "kind": "platform", "sub": "daily, signature-checked", "goal": "Refuse an unsigned metadata update rather than accept a fresher one.", "journeys": [ { "label": "Refresh the metadata snapshot" } ] }, { "id": "authn", "label": "Authenticator", "kind": "external", "sub": "platform or roaming", "goal": "Never hand the private key to anyone, this platform included.", "journeys": [ { "label": "Sign an assertion" }, { "label": "Refuse a duplicate credential" } ] } ] } ], "note": "Eight parties, three of them machines. The authenticator is in the cast because the one secret that matters never leaves it.", "meta": { "v": "1.0", "owner": "Security & Identity Architecture", "date": "2026-10" } }, { "id": "04-journey-enrol", "title": "Journey — The Everyday User Enrols a First Passkey", "layout": "journey", "actor": { "label": "Everyday user", "sub": "on a phone, mid-login", "goal": "Stop typing a password without taking on a new chore", "trigger": "Offered right after a successful password login", "success": "A working passkey, and a second way back in" }, "phases": [ { "title": "Offered", "sub": "after the password" }, { "title": "Decides" }, { "title": "Creates", "moment": true }, { "title": "Confirms" }, { "title": "Insures", "moment": true } ], "lanes": [ { "title": "What they do", "kind": "step", "cells": [ [ { "label": "Sees the offer" } ], [ { "label": "Asks what it replaces" } ], [ { "label": "Face or fingerprint" } ], [ { "label": "Names the device" } ], [ { "label": "Stores a recovery code" } ] ] }, { "title": "What the platform does", "kind": "system", "cells": [ [ { "label": "Offers once per login" } ], [ { "label": "Sends excludeCredentials" } ], [ { "label": "Verifies attestation" } ], [ { "label": "Records the verdict" } ], [ { "label": "Demands a second route" } ] ] }, { "title": "How it feels", "kind": "emotion", "levels": [ "Reassured", "Fine", "Uneasy" ], "points": [ 1, 0, 1, 2, 1 ] }, { "title": "Where it hurts", "kind": "pain", "cells": [ [], [ { "label": "No answer to \"what if I lose it\"" } ], [], [], [ { "label": "The code goes in a drawer" } ] ] }, { "title": "What answers it", "kind": "gain", "cells": [ [], [ { "label": "Second-route prompt is mandatory" } ], [], [ { "label": "Device list is human-readable" } ], [ { "label": "Cooling-off on the new credential" } ] ] } ], "chain": true, "note": "The trough is not the biometric. It is the unanswered question about loss, which is why section 3 refuses a silent single-credential account.", "meta": { "v": "1.0", "owner": "Security & Identity Architecture", "date": "2026-10" } }, { "id": "05-journey-recover", "title": "Journey — The User Who Has Lost Every Device", "layout": "journey", "actor": { "label": "Everyday user", "sub": "no working credential", "goal": "Get back into the account today", "trigger": "New phone; the old one is gone", "success": "Signed in, with a new passkey enrolled" }, "phases": [ { "title": "Locked out", "moment": true }, { "title": "Picks a route" }, { "title": "Proves it", "moment": true }, { "title": "Waits" }, { "title": "Back in" } ], "lanes": [ { "title": "What they do", "kind": "step", "cells": [ [ { "label": "Tries to sign in" } ], [ { "label": "Chooses what they still have" } ], [ { "label": "Follows the link, or calls" } ], [ { "label": "Waits out the window" } ], [ { "label": "Enrols a new passkey" } ] ] }, { "title": "What the platform does", "kind": "system", "cells": [ [ { "label": "No credential found" } ], [ { "label": "Offers configured routes only" } ], [ { "label": "Rate-limits per handle" } ], [ { "label": "Holds revocation rights" } ], [ { "label": "Requires a credential to finish" } ] ] }, { "title": "How it feels", "kind": "emotion", "levels": [ "Relieved", "Fine", "Stranded" ], "points": [ 0, 1, 1, 1, 2 ] }, { "title": "Where it hurts", "kind": "pain", "cells": [ [ { "label": "There is no password to reset" } ], [ { "label": "The tenant configured only email" } ], [], [ { "label": "Cannot evict the lost device yet" } ], [] ] }, { "title": "What answers it", "kind": "gain", "cells": [ [], [ { "label": "Assurance level rides the verdict" } ], [ { "label": "Cross-account bursts are an abuse signal" } ], [ { "label": "Takeover cannot evict the owner" } ], [ { "label": "Recovery that leaves no credential is incomplete" } ] ] } ], "chain": true, "note": "This journey starts in the trough. The architecture's job is the climb, and the only thing that makes the climb safe is that the route's weakness is carried into the verdict rather than forgotten.", "meta": { "v": "1.0", "owner": "Security & Identity Architecture", "date": "2026-10" } }, { "id": "06-journey-cutover", "title": "Journey — The Tenant Administrator Turns Off the Password", "layout": "journey", "actor": { "label": "Tenant administrator", "sub": "2.1 M end users", "goal": "Make the phishing-resistance claim actually true", "trigger": "Asked at a board review whether passwords are gone", "success": "Legacy path removed, support queue flat" }, "phases": [ { "title": "Measures" }, { "title": "Nudges" }, { "title": "Gated", "moment": true }, { "title": "Cuts over", "moment": true }, { "title": "Holds" } ], "lanes": [ { "title": "What they do", "kind": "step", "cells": [ [ { "label": "Reads coverage" } ], [ { "label": "Turns on the offer" } ], [ { "label": "Requests passkey-only" } ], [ { "label": "Sets the cutover date" } ], [ { "label": "Watches recovery volume" } ] ] }, { "title": "What the platform does", "kind": "system", "cells": [ [ { "label": "Three coverage figures" } ], [ { "label": "Records accept or decline" } ], [ { "label": "Refuses below threshold" } ], [ { "label": "Logs it as irreversible" } ], [ { "label": "Reports recovery cost" } ] ] }, { "title": "How it feels", "kind": "emotion", "levels": [ "Confident", "Fine", "Exposed" ], "points": [ 1, 1, 0, 1, 2 ] }, { "title": "Where it hurts", "kind": "pain", "cells": [ [], [ { "label": "Declines outnumber accepts" } ], [ { "label": "Two-or-more coverage is 41%" } ], [ { "label": "No undo once removed" } ], [] ] }, { "title": "What answers it", "kind": "gain", "cells": [ [ { "label": "The decision rests on data" } ], [], [ { "label": "Override is explicit and attributed" } ], [], [ { "label": "Recovery cost is a reported line" } ] ] } ], "chain": true, "note": "The trough is the platform refusing the thing the administrator came to do, which is the point: a cutover at 41% coverage is a support incident wearing a security announcement.", "meta": { "v": "1.0", "owner": "Security & Identity Architecture", "date": "2026-10" } }, { "id": "07-layered", "title": "Passkey Authentication Service — Layered Architecture", "layout": "bands", "layerHeaderWidth": 170, "bands": [ { "name": "Client and authenticator", "nodes": [ { "id": "wac", "label": "WebAuthn client", "kind": "external" }, { "id": "plat", "label": "Platform authenticator", "kind": "external", "sub": "synced" }, { "id": "roam", "label": "Roaming security key", "kind": "external", "sub": "device-bound" } ] }, { "name": "Edge", "nodes": [ { "id": "gw", "label": "Ceremony gateway", "kind": "integration", "sub": "Envoy" }, { "id": "orig", "label": "Origin and RP ID check", "kind": "integration" }, { "id": "shed", "label": "Limit and shed", "kind": "integration" } ] }, { "name": "Ceremony (hot)", "nodes": [ { "id": "issue", "label": "Challenge issuer", "kind": "app" }, { "id": "verify", "label": "Assertion verifier", "kind": "app" }, { "id": "attest", "label": "Attestation verifier", "kind": "app" }, { "id": "signer", "label": "Verdict signer", "kind": "security" } ] }, { "name": "Lifecycle (warm)", "nodes": [ { "id": "dev", "label": "Device manager", "kind": "app" }, { "id": "revoke", "label": "Revocation service", "kind": "app" }, { "id": "rec", "label": "Recovery orchestrator", "kind": "app" } ] }, { "name": "Control (cold)", "nodes": [ { "id": "treg", "label": "Tenant and RP-ID registry", "kind": "platform" }, { "id": "pol", "label": "Policy versioning", "kind": "platform", "sub": "impact analysis" }, { "id": "mdsin", "label": "Metadata ingest", "kind": "platform", "sub": "fail-static" } ] }, { "name": "State", "nodes": [ { "id": "cstore", "label": "Ceremony store", "kind": "store", "sub": "Redis, pinned" }, { "id": "cred", "label": "Credential store", "kind": "store", "sub": "CockroachDB" }, { "id": "handle", "label": "Handle directory", "kind": "store" }, { "id": "cfg", "label": "Tenant config cache", "kind": "store", "sub": "in-replica" } ] }, { "name": "Custody", "nodes": [ { "id": "vault", "label": "Vault and PKCS#11 HSM", "kind": "security" }, { "id": "mesh", "label": "Linkerd mTLS", "kind": "security" }, { "id": "opa", "label": "OPA Gatekeeper", "kind": "security", "sub": "admission policy" } ] }, { "name": "Evidence", "nodes": [ { "id": "bus", "label": "Kafka audit stream", "kind": "queue" }, { "id": "ch", "label": "ClickHouse", "kind": "store", "sub": "13 months" }, { "id": "mi", "label": "MinIO archive", "kind": "store", "sub": "7 years" } ] } ], "edges": [ { "from": "wac", "to": "gw", "label": "ceremony" }, { "from": "gw", "to": "verify", "label": "verified origin" }, { "from": "verify", "to": "cred", "label": "read" }, { "from": "signer", "to": "vault", "label": "PKCS#11" }, { "from": "pol", "to": "cfg", "label": "publish", "kind": "batch" }, { "from": "mdsin", "to": "attest", "kind": "batch" } ], "note": "Eight layers; exactly one of them holds durable truth about whether a credential may authenticate, and it is read-only from the hot path.", "meta": { "v": "1.0", "owner": "Security & Identity Architecture", "date": "2026-10" } }, { "id": "08-platform-components", "title": "Passkey Authentication Service — Platform Components", "layout": "nested", "boxes": [ { "title": "Ceremony plane — region-pinned, stateless replicas", "kind": "boundary", "dir": "row", "children": [ { "title": "Verification (stateless)", "kind": "boundary", "nodes": [ { "id": "issue", "label": "Challenge issuer", "kind": "app", "sub": "Go, 12 replicas" }, { "id": "verify", "label": "Assertion verifier", "kind": "app", "sub": "Go, 24 replicas" }, { "id": "attest", "label": "Attestation verifier", "kind": "app", "sub": "registration only" } ] }, { "title": "Region-pinned state", "kind": "boundary", "nodes": [ { "id": "cstore", "label": "Ceremony store", "kind": "store", "sub": "Redis, TTL 300 s" }, { "id": "cfg", "label": "Tenant config cache", "kind": "store", "sub": "in-replica, async" } ] } ] }, { "title": "Durable truth — globally replicated, read-mostly", "kind": "boundary", "dir": "row", "children": [ { "title": "Credentials", "kind": "boundary", "nodes": [ { "id": "cred", "label": "Credential store", "kind": "store", "sub": "CockroachDB" }, { "id": "handle", "label": "Handle directory", "kind": "store", "sub": "opaque handles" } ] }, { "title": "Warm plane", "kind": "boundary", "nodes": [ { "id": "dev", "label": "Device manager", "kind": "app" }, { "id": "revoke", "label": "Revocation service", "kind": "app", "sub": "two approvers" }, { "id": "rec", "label": "Recovery orchestrator", "kind": "app" } ] }, { "title": "Control plane", "kind": "boundary", "nodes": [ { "id": "treg", "label": "Tenant and RP-ID registry", "kind": "platform" }, { "id": "pol", "label": "Policy service", "kind": "platform", "sub": "versioned" }, { "id": "mdsin", "label": "Metadata ingest", "kind": "platform", "sub": "CronJob, signed" } ] } ] }, { "title": "Custody and evidence", "kind": "trust", "dir": "row", "children": [ { "title": "Key custody", "kind": "boundary", "nodes": [ { "id": "vault", "label": "Vault", "kind": "security", "sub": "PKCS#11 seal" }, { "id": "hsm", "label": "Network HSM", "kind": "security", "sub": "keys never leave" } ] }, { "title": "Evidence", "kind": "boundary", "nodes": [ { "id": "bus", "label": "Audit stream", "kind": "queue", "sub": "Kafka" }, { "id": "ch", "label": "ClickHouse", "kind": "store", "sub": "13 months hot" }, { "id": "mi", "label": "MinIO archive", "kind": "store", "sub": "7 years, chained" } ] } ] } ], "outside": [ { "id": "rp", "label": "Relying-party backend", "kind": "external" }, { "id": "authn", "label": "Authenticator", "kind": "external" }, { "id": "mds", "label": "FIDO Metadata Service", "kind": "external" } ], "edges": [ { "from": "verify", "to": "cred", "label": "read" }, { "from": "revoke", "to": "cred", "label": "state change" }, { "from": "pol", "to": "cfg", "label": "publish", "kind": "batch" }, { "from": "mds", "to": "mdsin", "label": "signed BLOB", "kind": "batch" }, { "from": "vault", "to": "hsm", "label": "PKCS#11" }, { "from": "bus", "to": "ch", "kind": "async" }, { "from": "ch", "to": "mi", "label": "age out", "kind": "batch" } ], "note": "Omitted for legibility: every service reads the config cache, every service writes the audit stream, and the recovery orchestrator enrols into the credential store.", "meta": { "v": "1.0", "owner": "Security & Identity Architecture", "date": "2026-10" } }, { "id": "09-integration", "title": "Passkey Authentication Service — Interface Catalogue", "layout": "hub", "left": { "title": "Consumers", "nodes": [ { "id": "rpapp", "label": "Relying-party app", "kind": "external", "sub": "web SDK and native", "rel": "begin, finish" }, { "id": "rpback", "label": "Relying-party backend", "kind": "external", "sub": "40 tenants", "rel": "verdict" }, { "id": "console", "label": "Tenant console", "kind": "app", "sub": "policy, coverage, recovery", "rel": "mgmt API" } ] }, "centre": { "title": "Passkey Authentication Service", "nodes": [ { "id": "core", "label": "Ceremony and lifecycle APIs", "kind": "app", "sub": "REST, mTLS inside" } ] }, "right": { "title": "Dependencies", "nodes": [ { "id": "mds", "label": "FIDO Metadata Service", "kind": "external", "sub": "signed BLOB", "rel": "daily pull", "dir": "out", "kind2": "batch" }, { "id": "oob", "label": "Out-of-band provider", "kind": "external", "sub": "tenant's own", "rel": "recovery msg", "dir": "out", "kind2": "async" }, { "id": "hsm", "label": "Network HSM", "kind": "security", "sub": "PKCS#11", "rel": "sign only", "dir": "out" } ] }, "note": "Three inbound interfaces, three outbound. None of the outbound three is on the authentication path; audit export to a tenant SIEM is a pull from the evidence store.", "meta": { "v": "1.0", "owner": "Security & Identity Architecture", "date": "2026-10" } }, { "id": "10-data-flow", "title": "Passkey Authentication Service — Data Flow", "layout": "flow", "chain": true, "align": "middle", "nodeWidth": 195, "stages": [ { "title": "Origin", "nodes": [ { "id": "cd", "label": "Client data", "kind": "external", "sub": "origin, challenge, type" }, { "id": "ad", "label": "Authenticator data", "kind": "external", "sub": "flags, counter, sig" } ] }, { "title": "Hot path", "nodes": [ { "id": "verify", "label": "Verification", "kind": "app", "sub": "no write but the ceremony" }, { "id": "cstore", "label": "Ceremony store", "kind": "store", "sub": "consumed once" } ] }, { "title": "Durable truth", "nodes": [ { "id": "cred", "label": "Credential records", "kind": "store", "sub": "public keys only" }, { "id": "handle", "label": "Handle directory", "kind": "store" } ] }, { "title": "Stream", "nodes": [ { "id": "bus", "label": "Audit stream", "kind": "queue", "sub": "buffered, RPO 5 s" } ] }, { "title": "Serving", "nodes": [ { "id": "ch", "label": "ClickHouse", "kind": "store", "sub": "13 months" }, { "id": "marts", "label": "Coverage marts", "kind": "store", "sub": "per tenant" } ] }, { "title": "Consumers", "nodes": [ { "id": "graf", "label": "Grafana", "kind": "platform", "sub": "SLO and abuse" }, { "id": "console", "label": "Tenant console", "kind": "app", "sub": "migration coverage" }, { "id": "mi", "label": "MinIO archive", "kind": "store", "sub": "7 years" } ] } ], "edges": [ { "from": "verify", "to": "cred", "label": "read, never write" }, { "from": "marts", "to": "console", "label": "coverage" } ], "note": "The only personal data that crosses into the stream is an opaque handle. Erasure deletes the credential and the mapping, and leaves the trail pseudonymous.", "meta": { "v": "1.0", "owner": "Security & Identity Architecture", "date": "2026-10" } }, { "id": "11-data-architecture", "title": "Passkey Authentication Service — Storage Zones by Rebuildability", "layout": "nested", "boxes": [ { "title": "Irreplaceable — losing a row locks a user out", "kind": "boundary", "nodes": [ { "id": "cred", "label": "Credential store", "kind": "store", "sub": "RPO 0, 480 GB" }, { "id": "handle", "label": "Handle directory", "kind": "store", "sub": "RPO 0" }, { "id": "treg", "label": "Tenant and RP-ID registry", "kind": "store", "sub": "RPO 0, small" } ] }, { "title": "Ephemeral — rebuilt by the user retrying", "kind": "boundary", "nodes": [ { "id": "cstore", "label": "Ceremony store", "kind": "store", "sub": "TTL 300 s" }, { "id": "vel", "label": "Velocity counters", "kind": "store", "sub": "risk only" }, { "id": "cfg", "label": "Tenant config cache", "kind": "store", "sub": "async refresh" } ] }, { "title": "Derived — rebuildable from the stream", "kind": "boundary", "nodes": [ { "id": "ch", "label": "ClickHouse hot store", "kind": "store", "sub": "13 months" }, { "id": "marts", "label": "Coverage marts", "kind": "store", "sub": "nightly" } ] }, { "title": "Write-once — the evidence", "kind": "trust", "nodes": [ { "id": "bus", "label": "Audit stream", "kind": "queue", "sub": "Kafka, 7 days" }, { "id": "mi", "label": "MinIO archive", "kind": "store", "sub": "hash-chained segments" } ] }, { "title": "Refreshed from upstream — never authored here", "kind": "boundary", "nodes": [ { "id": "mdssnap", "label": "Metadata snapshot", "kind": "store", "sub": "signed, fail-static" } ] } ], "edges": [ { "from": "bus", "to": "ch", "kind": "async" }, { "from": "ch", "to": "marts", "label": "aggregate", "kind": "batch" }, { "from": "bus", "to": "mi", "label": "sealed segments", "kind": "batch" } ], "note": "Four of the five zones can be lost and rebuilt. The backup budget belongs almost entirely to the first zone, which is 480 GB of it.", "meta": { "v": "1.0", "owner": "Security & Identity Architecture", "date": "2026-10" } }, { "id": "12-data-model", "title": "Passkey Authentication Service — Data Model", "layout": "er", "canvas": { "width": 1640, "cols": 4 }, "rowGap": 240, "entities": [ { "id": "tenant", "name": "tenant", "kind": "store", "row": 0, "col": 1, "attrs": [ "tenant_id PK", "name", "residency_region_set", "migration_mode", "legacy_removed_at" ] }, { "id": "rpid", "name": "rp_id", "kind": "store", "row": 0, "col": 0, "attrs": [ "rp_id PK", "tenant_id FK -> tenant", "domain_verified_at", "origin_allowlist" ] }, { "id": "policy", "name": "policy_version", "kind": "store", "row": 0, "col": 2, "attrs": [ "policy_version_id PK", "tenant_id FK -> tenant", "user_verification", "attestation_mode", "counter_mode", "effective_from" ] }, { "id": "handle", "name": "user_handle", "kind": "store", "row": 1, "col": 1, "attrs": [ "user_handle PK opaque", "tenant_id FK -> tenant", "rp_subject unique per tenant", "created_at" ] }, { "id": "cred", "name": "credential", "kind": "store", "row": 1, "col": 2, "attrs": [ "credential_id PK", "user_handle FK -> user_handle", "public_key", "cose_alg", "sign_counter", "backup_eligible", "label", "state active|revoked", "last_used_at" ] }, { "id": "verdict", "name": "admission_verdict", "kind": "store", "row": 1, "col": 3, "attrs": [ "credential_id PK FK -> credential", "aaguid", "attestation_result", "policy_version_id FK", "snapshot_age_s", "immutable" ] }, { "id": "ceremony", "name": "ceremony", "kind": "store", "row": 0, "col": 3, "attrs": [ "ceremony_id PK", "tenant_id", "user_handle nullable", "challenge", "policy_version_id", "expires_at", "consumed bool" ] }, { "id": "recovery", "name": "recovery_attempt", "kind": "store", "row": 1, "col": 0, "attrs": [ "attempt_id PK", "user_handle FK -> user_handle", "method", "assurance_level", "operator_id nullable", "outcome", "enrolled_credential_id FK" ] }, { "id": "audit", "name": "audit_event", "kind": "store", "row": 2, "col": 2, "attrs": [ "event_id PK", "tenant_id", "user_handle pseudonymous", "credential_id nullable", "kind", "verdict", "prev_hash", "occurred_at" ] } ], "relations": [ { "from": "tenant", "to": "rpid", "label": "1 : N", "from_side": "w", "to_side": "e" }, { "from": "tenant", "to": "policy", "label": "1 : N", "from_side": "e", "to_side": "w" }, { "from": "tenant", "to": "handle", "label": "1 : N", "from_side": "s", "to_side": "n" }, { "from": "policy", "to": "ceremony", "label": "1 : N", "from_side": "e", "to_side": "w" }, { "from": "handle", "to": "recovery", "label": "1 : N", "from_side": "w", "to_side": "e" }, { "from": "handle", "to": "cred", "label": "1 : N", "from_side": "e", "to_side": "w" }, { "from": "cred", "to": "verdict", "label": "1 : 1", "from_side": "e", "to_side": "w" }, { "from": "cred", "to": "audit", "label": "1 : N", "kind": "optional", "from_side": "s", "to_side": "n" } ], "note": "A credential's admission verdict is a separate, immutable row on purpose: the authentication path reads it and nothing rewrites it.", "meta": { "v": "1.0", "owner": "Security & Identity Architecture", "date": "2026-10" } }, { "id": "13-authentication-sequence", "title": "Critical Flow — One Authentication Ceremony", "layout": "sequence", "lifelines": [ { "id": "user", "label": "User", "kind": "actor" }, { "id": "client", "label": "WebAuthn client", "kind": "external" }, { "id": "auth", "label": "Authenticator", "kind": "external" }, { "id": "gw", "label": "Ceremony gateway", "kind": "integration" }, { "id": "verify", "label": "Assertion verifier", "kind": "app" }, { "id": "cstore", "label": "Ceremony store", "kind": "store" }, { "id": "cred", "label": "Credential store", "kind": "store" }, { "id": "risk", "label": "Risk engine", "kind": "platform" } ], "messages": [ { "from": "user", "to": "client", "label": "asks to sign in", "kind": "call" }, { "from": "client", "to": "gw", "label": "POST /ceremony/begin", "kind": "call" }, { "from": "gw", "to": "verify", "label": "origin and rate checked", "kind": "call" }, { "from": "verify", "to": "cstore", "label": "put challenge, TTL 300 s", "kind": "call" }, { "from": "verify", "to": "client", "label": "challenge + allowCredentials", "kind": "return" }, { "from": "client", "to": "auth", "label": "credentials.get()", "kind": "call" }, { "from": "auth", "to": "client", "label": "signed assertion", "kind": "return" }, { "from": "client", "to": "gw", "label": "POST /ceremony/finish", "kind": "call" }, { "from": "gw", "to": "verify", "label": "assertion", "kind": "call" }, { "from": "verify", "to": "cstore", "label": "consume atomically", "kind": "call" }, { "from": "verify", "to": "cred", "label": "load key and verdict", "kind": "call" }, { "from": "verify", "to": "verify", "label": "signature, origin, flags", "kind": "self" }, { "from": "verify", "to": "risk", "label": "score, 15 ms deadline", "kind": "call" }, { "from": "risk", "to": "verify", "label": "timeout: unevaluated", "kind": "error" }, { "from": "verify", "to": "cred", "label": "counter observed", "kind": "async" }, { "from": "verify", "to": "client", "label": "signed verdict", "kind": "return" }, { "from": "client", "to": "user", "label": "signed in", "kind": "return" } ], "note": "Message 14 is the designed case, not the exception: a risk engine that cannot answer in time marks the verdict unevaluated and the ceremony still completes.", "meta": { "v": "1.0", "owner": "Security & Identity Architecture", "date": "2026-10" } }, { "id": "14-registration-pipeline", "title": "Passkey Authentication Service — Registration and Admission Pipeline", "layout": "flow", "chain": true, "align": "middle", "nodeWidth": 190, "stages": [ { "title": "Begin", "nodes": [ { "id": "chal", "label": "Challenge issued", "kind": "app", "sub": "bound to handle" }, { "id": "excl", "label": "excludeCredentials", "kind": "app", "sub": "no duplicates" } ] }, { "title": "Create", "nodes": [ { "id": "auth", "label": "Authenticator", "kind": "external", "sub": "makes the key pair" } ] }, { "title": "Verify", "nodes": [ { "id": "cdv", "label": "Client data check", "kind": "app", "sub": "origin, type, challenge" }, { "id": "att", "label": "Attestation statement", "kind": "app", "sub": "chain and format" } ] }, { "title": "Resolve", "nodes": [ { "id": "snap", "label": "Metadata snapshot", "kind": "store", "sub": "signed, may be stale" }, { "id": "polv", "label": "Policy version", "kind": "platform", "sub": "in force now" } ] }, { "title": "Admit", "nodes": [ { "id": "verdict", "label": "Admission verdict", "kind": "decision", "sub": "immutable once written" } ] }, { "title": "Persist", "nodes": [ { "id": "cred", "label": "Credential store", "kind": "store", "sub": "atomic with verdict" } ] }, { "title": "Insure", "nodes": [ { "id": "second", "label": "Second-route prompt", "kind": "app", "sub": "or an acknowledgement" }, { "id": "code", "label": "Recovery code", "kind": "security", "sub": "shown once" } ] } ], "edges": [ { "from": "att", "to": "verdict", "label": "unverified is allowed" }, { "from": "verdict", "to": "auth", "label": "refused: nothing persisted", "kind": "error", "route": "gutter" } ], "note": "A registration that cannot be admitted leaves no partial record. The verdict and the credential are written together or not at all.", "meta": { "v": "1.0", "owner": "Security & Identity Architecture", "date": "2026-10" } }, { "id": "15-recovery-routes", "title": "Passkey Authentication Service — Recovery Routes and Their Assurance", "layout": "swimlane", "stages": [ "Claim", "Prove", "Cool off", "Re-enrol", "Record" ], "laneHeaderWidth": 180, "lanes": [ { "title": "Second passkey", "cells": [ [ { "label": "Handle identified", "kind": "app" } ], [ { "label": "Assertion on the other credential", "kind": "app" } ], [ { "label": "None", "kind": "opportunity" } ], [ { "label": "New credential", "kind": "app" } ], [ { "label": "Assurance: high", "kind": "opportunity" } ] ] }, { "title": "One-time code", "cells": [ [ { "label": "Handle identified", "kind": "app" } ], [ { "label": "Code plus velocity check", "kind": "app" } ], [ { "label": "15 minutes", "kind": "decision" } ], [ { "label": "New credential", "kind": "app" } ], [ { "label": "Assurance: medium", "kind": "decision" } ] ] }, { "title": "Out-of-band channel", "cells": [ [ { "label": "Handle identified", "kind": "app" } ], [ { "label": "Link to a tenant channel", "kind": "integration" } ], [ { "label": "60 minutes", "kind": "decision" } ], [ { "label": "New credential", "kind": "app" } ], [ { "label": "Assurance: low", "kind": "risk" } ] ] }, { "title": "Assisted by support", "cells": [ [ { "label": "Ticket plus handle", "kind": "actor" } ], [ { "label": "Agent-run evidence check", "kind": "actor" } ], [ { "label": "24 hours", "kind": "decision" } ], [ { "label": "New credential", "kind": "app" } ], [ { "label": "Operator named in audit", "kind": "security" } ] ] } ], "note": "The cool-off column is the whole argument: the weaker the proof, the longer the new credential waits before it may revoke anything.", "meta": { "v": "1.0", "owner": "Security & Identity Architecture", "date": "2026-10" } }, { "id": "16-deployment", "title": "Passkey Authentication Service — Deployment Topology", "layout": "nested", "boxes": [ { "title": "Region eu-central — serves EU-pinned tenants", "kind": "onprem", "dir": "row", "children": [ { "title": "Zone A", "kind": "boundary", "nodes": [ { "id": "pods-a", "label": "Verification pods", "kind": "app", "sub": "Kubernetes, 24" }, { "id": "redis-a", "label": "Redis shard", "kind": "store", "sub": "ceremony, primary" }, { "id": "crdb-a", "label": "CockroachDB node", "kind": "store" } ] }, { "title": "Zone B", "kind": "boundary", "nodes": [ { "id": "pods-b", "label": "Verification pods", "kind": "app", "sub": "Kubernetes, 24" }, { "id": "redis-b", "label": "Redis replica", "kind": "store" }, { "id": "crdb-b", "label": "CockroachDB node", "kind": "store" } ] }, { "title": "Zone C", "kind": "boundary", "nodes": [ { "id": "crdb-c", "label": "CockroachDB node", "kind": "store", "sub": "quorum third" }, { "id": "hsm-eu", "label": "Network HSM pair", "kind": "security", "sub": "PKCS#11" } ] } ] }, { "title": "Region us-east — serves unpinned tenants", "kind": "onprem", "dir": "row", "children": [ { "title": "Zones A to C", "kind": "boundary", "nodes": [ { "id": "pods-us", "label": "Verification pods", "kind": "app", "sub": "Kubernetes, 16" }, { "id": "redis-us", "label": "Redis cluster", "kind": "store", "sub": "independent, pinned" }, { "id": "crdb-us", "label": "CockroachDB nodes", "kind": "store", "sub": "same global cluster" } ] } ] }, { "title": "Shared platform services", "kind": "trust", "nodes": [ { "id": "argo", "label": "Argo CD", "kind": "platform", "sub": "GitOps, per region" }, { "id": "prom", "label": "Prometheus and Grafana", "kind": "platform" }, { "id": "kafka", "label": "Kafka and ClickHouse", "kind": "store", "sub": "evidence" } ] } ], "outside": [ { "id": "dns", "label": "Anycast ingress", "kind": "external", "sub": "region per tenant pin" }, { "id": "mds", "label": "FIDO Metadata Service", "kind": "external" } ], "edges": [ { "from": "crdb-a", "to": "crdb-us", "label": "Raft, cross-region", "kind": "batch" }, { "from": "dns", "to": "pods-a", "label": "pinned tenants" }, { "from": "dns", "to": "pods-us", "label": "everyone else" } ], "note": "Deliberately absent: any replication between the two Redis clusters. Ceremony state is never replicated, so a region loss costs a retry and never a wrong decision.", "meta": { "v": "1.0", "owner": "Security & Identity Architecture", "date": "2026-10" } }, { "id": "17-release-pipeline", "title": "Passkey Authentication Service — Code and Policy Release Pipeline", "layout": "flow", "chain": true, "align": "middle", "nodeWidth": 195, "stages": [ { "title": "Source", "nodes": [ { "id": "git", "label": "Git repository", "kind": "store", "sub": "services and policy" } ] }, { "title": "Build", "nodes": [ { "id": "img", "label": "Container image", "kind": "app", "sub": "digest-addressed" }, { "id": "sbom", "label": "SBOM and signature", "kind": "security" } ] }, { "title": "Gate", "nodes": [ { "id": "unit", "label": "Unit and fuzz", "kind": "app" }, { "id": "conf", "label": "WebAuthn test vectors", "kind": "app", "sub": "conformance suite" }, { "id": "impact", "label": "Policy impact analysis", "kind": "decision", "sub": "who gets locked out" } ] }, { "title": "Staging", "nodes": [ { "id": "stage", "label": "Tenant staging RP IDs", "kind": "app", "sub": "isolated credentials" } ] }, { "title": "Canary", "nodes": [ { "id": "canary", "label": "One region, 5%", "kind": "app", "sub": "ceremony outcome watch" } ] }, { "title": "Production", "nodes": [ { "id": "argo", "label": "Argo CD sync", "kind": "platform", "sub": "all regions" }, { "id": "polv", "label": "Policy version live", "kind": "platform", "sub": "new ceremonies only" } ] } ], "edges": [ { "from": "impact", "to": "git", "label": "refused: 14 k would lock out", "kind": "error", "route": "gutter" }, { "from": "canary", "to": "argo", "label": "outcome rate flat" } ], "note": "A policy change travels the same pipeline as code, and the gate that can stop it is the one that counts the users it would lock out.", "meta": { "v": "1.0", "owner": "Security & Identity Architecture", "date": "2026-10" } }, { "id": "18-observability", "title": "Passkey Authentication Service — Observability Matrix", "layout": "grid", "stages": [ "Edge", "Ceremony", "State", "Lifecycle and recovery", "Evidence" ], "laneHeaderWidth": 170, "lanes": [ { "title": "Metrics", "cells": [ [ { "label": "Shed rate", "kind": "platform" } ], [ { "label": "Verify p50 and p99", "kind": "platform" } ], [ { "label": "Consume latency", "kind": "platform" }, { "label": "Replication lag", "kind": "platform" } ], [ { "label": "Recovery completion", "kind": "platform" } ], [ { "label": "Stream lag", "kind": "platform" } ] ] }, { "title": "Logs", "cells": [ [ { "label": "Origin mismatch by tenant", "kind": "app" } ], [ { "label": "Ceremony outcome codes", "kind": "app" } ], [ { "label": "Store timeouts", "kind": "app" } ], [ { "label": "Operator-assisted events", "kind": "security" } ], [ { "label": "Chain-write failures", "kind": "risk" } ] ] }, { "title": "Traces", "cells": [ [ { "label": "Ingress span", "kind": "platform" } ], [ { "label": "Verify and risk deadline", "kind": "platform" } ], [ { "label": "Store spans", "kind": "platform" } ], [ { "label": "Recovery orchestration", "kind": "platform" } ], [] ] }, { "title": "SLO alerts", "cells": [ [ { "label": "Shed above 1% for 5 min", "kind": "risk" } ], [ { "label": "p99 above 60 ms for 10 min", "kind": "risk" } ], [ { "label": "Consume failure above 0.1%", "kind": "risk" } ], [ { "label": "Recovery below 95% in 10 min", "kind": "risk" } ], [ { "label": "Hash-chain gap", "kind": "risk" } ] ] }, { "title": "Tenant signals", "cells": [ [], [ { "label": "Abandonment rate", "kind": "opportunity" } ], [], [ { "label": "Credential coverage", "kind": "opportunity" } ], [ { "label": "Two-or-more coverage", "kind": "opportunity" } ] ] } ], "note": "The blank cells are deliberate. The bottom row is what a tenant administrator reads, and most of the pipeline has nothing to tell them.", "meta": { "v": "1.0", "owner": "Security & Identity Architecture", "date": "2026-10" } }, { "id": "19-credential-lifecycle", "title": "Passkey Authentication Service — The Credential Lifecycle Loop", "layout": "cycle", "centre": { "label": "Credential lifecycle" }, "rx": 430, "ry": 215, "nodes": [ { "id": "admitted", "label": "Admitted", "kind": "decision", "sub": "verdict written" }, { "id": "inuse", "label": "In use", "kind": "app", "sub": "assertions verified" }, { "id": "observed", "label": "Observed", "kind": "platform", "sub": "counter, risk, last used" }, { "id": "reeval", "label": "Re-evaluated", "kind": "security", "sub": "compromise notice" }, { "id": "decided", "label": "Decided", "kind": "decision", "sub": "two approvers" }, { "id": "revoked", "label": "Revoked", "kind": "risk", "sub": "state change, record kept" }, { "id": "replaced", "label": "Replaced", "kind": "opportunity", "sub": "re-enrolled" } ], "ringLabels": [ "first assertion", "signals", "metadata notice", "raised, never automatic", "revocation", "recovery or add-device", "admitted again" ], "note": "The loop closes through Replaced, not through Revoked. A revocation that leaves a user with nothing is an unfinished lifecycle, not a completed one.", "meta": { "v": "1.0", "owner": "Security & Identity Architecture", "date": "2026-10" } }, { "id": "20-security-zones", "title": "Passkey Authentication Service — Trust Zones and Segmentation", "layout": "zones", "zones": [ { "title": "Internet", "kind": "trust", "nodes": [ { "id": "device", "label": "User device", "kind": "external" }, { "id": "client", "label": "WebAuthn client", "kind": "external" }, { "id": "authn", "label": "Authenticator", "kind": "external", "sub": "holds the private key" } ] }, { "title": "Perimeter", "kind": "trust", "nodes": [ { "id": "gw", "label": "Ceremony gateway", "kind": "integration", "sub": "TLS, origin allowlist" }, { "id": "shed", "label": "Limit and shed", "kind": "integration" } ] }, { "title": "Ceremony zone — holds no durable secret", "kind": "trust", "nodes": [ { "id": "pods", "label": "Verification pods", "kind": "app", "sub": "stateless" }, { "id": "cstore", "label": "Ceremony store", "kind": "store", "sub": "TTL 300 s" } ] }, { "title": "Data zone", "kind": "trust", "nodes": [ { "id": "cred", "label": "Credential store", "kind": "store", "sub": "public keys only" }, { "id": "handle", "label": "Handle directory", "kind": "store", "sub": "opaque handles" } ] }, { "title": "Custody zone", "kind": "trust", "nodes": [ { "id": "vault", "label": "Vault", "kind": "security" }, { "id": "hsm", "label": "Network HSM", "kind": "security", "sub": "keys never leave" } ] }, { "title": "Evidence zone", "kind": "trust", "nodes": [ { "id": "bus", "label": "Audit stream", "kind": "queue" }, { "id": "mi", "label": "MinIO archive", "kind": "store", "sub": "write-once" } ] } ], "edges": [ { "from": "client", "to": "gw", "label": "TLS 1.3 only" }, { "from": "gw", "to": "pods", "label": "mTLS, Linkerd" }, { "from": "pods", "to": "cred", "label": "tenant-scoped SQL" }, { "from": "pods", "to": "vault", "label": "sign only" }, { "from": "pods", "to": "bus", "label": "append only", "kind": "async" } ], "note": "A full dump of the data zone authenticates nobody. That is the property the segmentation exists to preserve, and the reason the custody zone is small.", "meta": { "v": "1.0", "owner": "Security & Identity Architecture", "date": "2026-10" } }, { "id": "21-verdict-to-session", "title": "Identity Flow — From Verdict to the Tenant's Own Session", "layout": "sequence", "lifelines": [ { "id": "user", "label": "User", "kind": "actor" }, { "id": "client", "label": "WebAuthn client", "kind": "external" }, { "id": "platform", "label": "Verdict signer", "kind": "app" }, { "id": "vault", "label": "Vault and HSM", "kind": "security" }, { "id": "rp", "label": "Relying-party backend", "kind": "external" }, { "id": "jwks", "label": "Verification material", "kind": "store" } ], "messages": [ { "from": "user", "to": "client", "label": "completes the assertion", "kind": "call" }, { "from": "client", "to": "platform", "label": "finish ceremony", "kind": "call" }, { "from": "platform", "to": "vault", "label": "sign verdict", "kind": "call" }, { "from": "vault", "to": "platform", "label": "signature", "kind": "return" }, { "from": "platform", "to": "client", "label": "verdict, 60 s, single use", "kind": "return" }, { "from": "client", "to": "rp", "label": "POST /session", "kind": "call" }, { "from": "rp", "to": "jwks", "label": "fetch key, cached", "kind": "call" }, { "from": "rp", "to": "rp", "label": "check nonce, assurance, audience", "kind": "self" }, { "from": "rp", "to": "user", "label": "its own session cookie", "kind": "return" } ], "note": "There is no message where the platform issues a session, and none where it revokes one. Logout, session lifetime and step-up stay with the relying party.", "meta": { "v": "1.0", "owner": "Security & Identity Architecture", "date": "2026-10" } } ]