Authentication Assurance Policies
How strongly each subject must authenticate — by user type, operation risk, and regulatory regime. Authentication is a precondition, never an authorization grant.
| Policy | User type | Risk | Required AAL | Phishing-resistant | Source | Save |
|---|---|---|---|---|---|---|
| Loading policies… | ||||||
Decision simulator
A satisfied assurance policy permits an authorization check to proceed; it does not itself grant any permission.