Password verifies knowledge.
MFA should raise assurance.
Step-up should bind assurance to risk and action.
Recovery must not be weaker than the protected account.

Authentication is not a boolean.
Authentication creates an assurance state.
Assurance can expire, degrade, or need elevation.

Apakah user sudah login?

Siapa subject ini?
Dengan authenticator apa dia dibuktikan?
Kapan terakhir dibuktikan?
Level assurance apa yang berlaku?
Action apa yang boleh dilakukan dengan assurance itu?
Apakah risiko saat ini mengharuskan step-up?

MFA factor != delivery channel.

OTP is one possible authenticator mechanism.
MFA is a policy outcome.
Step-up is a policy-triggered authentication transition.

public enum AssuranceLevel {
    ANONYMOUS,
    PASSWORD_ONLY,
    MFA_WEAK,
    MFA_STRONG,
    PHISHING_RESISTANT,
    ADMIN_REAUTHENTICATED
}

public record AuthenticationEvidence(
        UUID subjectId,
        UUID accountId,
        UUID tenantId,
        Instant authenticatedAt,
        Instant lastPasswordVerifiedAt,
        Instant lastMfaVerifiedAt,
        Set<String> authenticatorMethods,
        AssuranceLevel assuranceLevel,
        String authenticationSessionId,
        String deviceId,
        String ipAddress,
        String userAgent
) {}

Action: change payout bank account
Required:
- authenticated within last 10 minutes
- MFA method not email_otp
- phishing-resistant method preferred
- device risk not high

T+0m   password + TOTP verified
T+5m   user boleh melihat profile
T+20m  user masih login, tetapi butuh step-up untuk ubah email
T+8h   session idle timeout
T+30d  remember-me mungkin masih ada, tetapi assurance rendah

public record StepUpRequirement(
        AssuranceLevel minimumLevel,
        Duration maxAge,
        Set<String> allowedMethods,
        boolean requireFreshPassword,
        boolean requirePhishingResistant
) {}

public final class AssurancePolicy {

    public boolean satisfies(AuthenticationEvidence evidence,
                             StepUpRequirement requirement,
                             Instant now) {
        if (evidence.assuranceLevel().ordinal() < requirement.minimumLevel().ordinal()) {
            return false;
        }

        Instant reference = evidence.lastMfaVerifiedAt() != null
                ? evidence.lastMfaVerifiedAt()
                : evidence.authenticatedAt();

        if (reference == null || reference.plus(requirement.maxAge()).isBefore(now)) {
            return false;
        }

        if (!requirement.allowedMethods().isEmpty()) {
            boolean hasAllowed = evidence.authenticatorMethods().stream()
                    .anyMatch(requirement.allowedMethods()::contains);
            if (!hasAllowed) {
                return false;
            }
        }

        if (requirement.requirePhishingResistant()) {
            return evidence.authenticatorMethods().contains("webauthn")
                    || evidence.authenticatorMethods().contains("smart_card")
                    || evidence.authenticatorMethods().contains("certificate_bound");
        }

        return true;
    }
}

if (!session.isMfaDone()) throw ...

A partially authenticated session must never be treated as fully authenticated.

PASSWORD_VERIFIED_PENDING_MFA

AUTHENTICATED = true

create table account_authenticator (
    id uuid primary key,
    tenant_id uuid not null,
    account_id uuid not null,
    method varchar(64) not null,
    label varchar(128),
    status varchar(32) not null,
    secret_hash bytea,
    secret_encrypted bytea,
    public_key_cose bytea,
    credential_id bytea,
    phone_e164 varchar(32),
    email varchar(320),
    added_at timestamptz not null,
    verified_at timestamptz,
    last_used_at timestamptz,
    disabled_at timestamptz,
    disabled_reason varchar(256),
    created_by_auth_event_id uuid,
    version bigint not null default 0
);

create index idx_authenticator_account
    on account_authenticator(tenant_id, account_id, status);

create unique index uq_active_webauthn_credential
    on account_authenticator(tenant_id, credential_id)
    where method = 'webauthn' and status = 'active';

create table authentication_challenge (
    id uuid primary key,
    tenant_id uuid not null,
    account_id uuid,
    authentication_session_id uuid not null,
    method varchar(64) not null,
    purpose varchar(64) not null,
    challenge_hash bytea not null,
    destination_hash bytea,
    issued_at timestamptz not null,
    expires_at timestamptz not null,
    consumed_at timestamptz,
    failed_attempts int not null default 0,
    max_attempts int not null,
    status varchar(32) not null,
    risk_snapshot jsonb not null default '{}'::jsonb
);

create index idx_challenge_session
    on authentication_challenge(authentication_session_id, status, expires_at);

create table account_recovery_code (
    id uuid primary key,
    tenant_id uuid not null,
    account_id uuid not null,
    code_hash bytea not null,
    batch_id uuid not null,
    created_at timestamptz not null,
    used_at timestamptz,
    used_auth_event_id uuid,
    status varchar(32) not null
);

create index idx_recovery_code_account
    on account_recovery_code(tenant_id, account_id, status);

create table trusted_device (
    id uuid primary key,
    tenant_id uuid not null,
    account_id uuid not null,
    device_token_hash bytea not null,
    label varchar(128),
    created_at timestamptz not null,
    last_seen_at timestamptz,
    expires_at timestamptz not null,
    revoked_at timestamptz,
    risk_binding jsonb not null default '{}'::jsonb
);

create unique index uq_trusted_device_token
    on trusted_device(tenant_id, device_token_hash)
    where revoked_at is null;

Do not store OTP code plaintext.
Do not store recovery code plaintext.
Do not store TOTP secret unencrypted.
Do not store trusted-device token plaintext.

Default consumer user:
- TOTP or passkey recommended
- email OTP only for recovery bootstrap

Admin user:
- phishing-resistant MFA required
- recovery requires support workflow + second admin approval

Machine/service account:
- no human MFA
- use client credentials, mTLS, private_key_jwt, workload identity

TOTP enrollment is not complete until the first code is verified.
A TOTP code should not be accepted repeatedly in the same time window for the same account.
TOTP secrets must be encrypted or protected with KMS/HSM-level controls.
TOTP verification must be rate-limited per account, IP, device, and challenge.
TOTP clock skew tolerance must be small and explicit.

public interface TotpVerifier {
    boolean verify(String secretBase32, String submittedCode, Instant now);
}

public final class TotpMfaService {

    private final AuthenticatorRepository authenticators;
    private final ChallengeRepository challenges;
    private final TotpVerifier verifier;
    private final RateLimiter rateLimiter;
    private final AuditLogger audit;
    private final Clock clock;

    public MfaResult verifyTotp(VerifyTotpCommand command) {
        Instant now = clock.instant();

        AuthenticationChallenge challenge = challenges.findActive(command.challengeId())
                .orElseThrow(() -> MfaResult.invalid("Invalid or expired challenge").asException());

        if (challenge.isExpired(now) || challenge.isConsumed()) {
            audit.mfaFailed(command.accountId(), "totp", "expired_challenge");
            return MfaResult.invalid("Invalid or expired challenge");
        }

        rateLimiter.checkOrThrow(RateLimitKey.mfa(
                command.tenantId(), command.accountId(), command.ipAddress()));

        AccountAuthenticator authenticator = authenticators.findActiveTotp(
                command.tenantId(), command.accountId())
                .orElseThrow(() -> MfaResult.invalid("Invalid or expired challenge").asException());

        String secret = decryptSecret(authenticator.encryptedSecret());
        boolean valid = verifier.verify(secret, command.code(), now);

        if (!valid) {
            challenges.incrementFailedAttempts(challenge.id());
            audit.mfaFailed(command.accountId(), "totp", "invalid_code");
            return MfaResult.invalid("Invalid or expired challenge");
        }

        if (challenges.wasTotpTimeStepAlreadyUsed(
                command.accountId(), authenticator.id(), currentTotpStep(now))) {
            audit.mfaFailed(command.accountId(), "totp", "replay_same_step");
            return MfaResult.invalid("Invalid or expired challenge");
        }

        challenges.consume(challenge.id(), now);
        authenticators.markUsed(authenticator.id(), now);
        audit.mfaSucceeded(command.accountId(), "totp");

        return MfaResult.success(MfaEvidence.totp(authenticator.id(), now));
    }
}

public final class OtpGenerator {
    private final SecureRandom secureRandom = new SecureRandom();

    public String sixDigitCode() {
        int n = secureRandom.nextInt(1_000_000);
        return String.format("%06d", n);
    }
}

public record OtpChallenge(
        UUID id,
        UUID tenantId,
        UUID accountId,
        UUID authenticationSessionId,
        String method,
        String purpose,
        byte[] codeHash,
        byte[] destinationHash,
        Instant issuedAt,
        Instant expiresAt,
        int failedAttempts,
        int maxAttempts,
        ChallengeStatus status
) {}

public final class OtpHasher {
    private final MacFactory macFactory;

    public byte[] hash(UUID challengeId, String code) {
        Mac mac = macFactory.hmacSha256();
        mac.update(challengeId.toString().getBytes(StandardCharsets.UTF_8));
        mac.update((byte) ':');
        mac.update(code.getBytes(StandardCharsets.UTF_8));
        return mac.doFinal();
    }

    public boolean matches(UUID challengeId, String submitted, byte[] expected) {
        byte[] actual = hash(challengeId, submitted);
        return MessageDigest.isEqual(actual, expected);
    }
}

select challenge
if code valid:
  update consumed_at

Request A verifies code
Request B verifies same code
Both update consumed_at

update authentication_challenge
set consumed_at = now(), status = 'consumed'
where id = :challenge_id
  and status = 'active'
  and consumed_at is null
  and expires_at > now();

single-use
random
long enough
shown once
stored hashed
rate-limited
notified on use
regenerated as batch
revocable
visible in audit

7J9K-M4Q2-P8RT

public final class RecoveryCodeGenerator {
    private static final char[] ALPHABET = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789".toCharArray();
    private final SecureRandom random = new SecureRandom();

    public String generate() {
        StringBuilder out = new StringBuilder();
        for (int group = 0; group < 3; group++) {
            if (group > 0) out.append('-');
            for (int i = 0; i < 4; i++) {
                out.append(ALPHABET[random.nextInt(ALPHABET.length)]);
            }
        }
        return out.toString();
    }
}

public RecoveryResult useRecoveryCode(UseRecoveryCodeCommand command) {
    rateLimiter.checkOrThrow(RateLimitKey.recoveryCode(
            command.tenantId(), command.accountId(), command.ipAddress()));

    List<RecoveryCodeRecord> active = repository.findActive(command.tenantId(), command.accountId());

    for (RecoveryCodeRecord record : active) {
        if (passwordEncoder.matches(command.code(), record.hash())) {
            boolean consumed = repository.consume(record.id(), command.authEventId(), clock.instant());
            if (!consumed) {
                return RecoveryResult.invalid();
            }

            audit.recoveryCodeUsed(command.accountId(), command.ipAddress());
            notifier.notifyRecoveryCodeUsed(command.accountId());
            return RecoveryResult.success(record.id());
        }
    }

    audit.recoveryCodeFailed(command.accountId(), command.ipAddress());
    return RecoveryResult.invalid();
}

Recovery code success should notify user immediately.
Recovery code use should often force user to regenerate remaining codes.
Recovery code should not silently disable all MFA.

User loses TOTP.
Support asks birth date.
Support disables MFA.
Attacker logs in with stolen password.

Effective security = min(login strength, recovery strength)

Recovery should restore access into a constrained state, not directly into full assurance.

random >= 128 bits
stored only as hash/MAC
cookie HttpOnly + Secure + SameSite
bounded lifetime
revocable
bound to account + tenant
optionally bound to device fingerprint/risk signals
not accepted for high-risk actions without fresh step-up

Set-Cookie: td=opaque_random_value; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=2592000

Device fingerprint can help risk scoring.
Device fingerprint must not replace authentication.

Before a sensitive action, require fresh authentication evidence with sufficient assurance.

Approve transfer of $10,000 to ACME Bank ****1234

Enter MFA code

public final class AuthenticatedUserPrincipal implements UserDetails {
    private final UUID accountId;
    private final UUID tenantId;
    private final String username;
    private final Set<GrantedAuthority> authorities;
    private final AuthenticationEvidence evidence;

    public AuthenticationEvidence evidence() {
        return evidence;
    }

    // UserDetails methods omitted
}

@Component
public final class StepUpGuard {

    private final AssurancePolicy assurancePolicy;
    private final Clock clock;

    public void require(Authentication authentication, StepUpRequirement requirement) {
        AuthenticatedUserPrincipal principal =
                (AuthenticatedUserPrincipal) authentication.getPrincipal();

        if (!assurancePolicy.satisfies(principal.evidence(), requirement, clock.instant())) {
            throw new StepUpRequiredException(requirement);
        }
    }
}

@PostMapping("/tenant/{tenantId}/api-keys")
public ApiKeyResponse createApiKey(@PathVariable UUID tenantId,
                                   @RequestBody CreateApiKeyRequest request,
                                   Authentication authentication) {
    stepUpGuard.require(authentication, StepUpRequirements.CREATE_API_KEY);
    return apiKeyService.create(tenantId, request, authentication);
}

@RestControllerAdvice
public final class StepUpExceptionHandler {

    @ExceptionHandler(StepUpRequiredException.class)
    ResponseEntity<StepUpRequiredResponse> handle(StepUpRequiredException ex) {
        return ResponseEntity.status(HttpStatus.FORBIDDEN).body(
                new StepUpRequiredResponse(
                        "STEP_UP_REQUIRED",
                        ex.requirement().minimumLevel().name(),
                        ex.requirement().maxAge().toSeconds(),
                        ex.requirement().allowedMethods()
                )
        );
    }
}

public void upgradeCurrentSession(MfaEvidence mfaEvidence) {
    Authentication current = SecurityContextHolder.getContext().getAuthentication();
    AuthenticatedUserPrincipal old = (AuthenticatedUserPrincipal) current.getPrincipal();

    AuthenticatedUserPrincipal upgraded = old.withEvidence(
            old.evidence().withMfa(
                    mfaEvidence.method(),
                    mfaEvidence.verifiedAt(),
                    mfaEvidence.toAssuranceLevel()
            )
    );

    Authentication upgradedAuth = new UsernamePasswordAuthenticationToken(
            upgraded,
            current.getCredentials(),
            current.getAuthorities()
    );

    SecurityContextHolder.getContext().setAuthentication(upgradedAuth);
}

/login/password -> creates partial auth session
/login/mfa/*    -> completes MFA and upgrades session
/protected/**   -> requires full authentication

public final class MfaRequiredFilter extends OncePerRequestFilter {

    private final RequestMatcher protectedMatcher;

    @Override
    protected void doFilterInternal(HttpServletRequest request,
                                    HttpServletResponse response,
                                    FilterChain chain)
            throws ServletException, IOException {

        Authentication authentication = SecurityContextHolder.getContext().getAuthentication();

        if (requiresFullAuth(request) && isPartial(authentication)) {
            response.setStatus(HttpServletResponse.SC_FORBIDDEN);
            response.setContentType("application/json");
            response.getWriter().write("{\"code\":\"MFA_REQUIRED\"}");
            return;
        }

        chain.doFilter(request, response);
    }

    private boolean isPartial(Authentication authentication) {
        if (authentication == null || !authentication.isAuthenticated()) {
            return false;
        }
        Object principal = authentication.getPrincipal();
        return principal instanceof PartialAuthenticationPrincipal;
    }

    private boolean requiresFullAuth(HttpServletRequest request) {
        return protectedMatcher.matches(request);
    }
}

Password correct -> auth_session_id cookie with limited scope
MFA correct      -> rotate session -> full application session

@ApplicationScoped
public class MfaAwareAuthenticationMechanism implements HttpAuthenticationMechanism {

    @Inject IdentityStoreHandler identityStoreHandler;
    @Inject AuthenticationSessionService sessions;

    @Override
    public AuthenticationStatus validateRequest(HttpServletRequest request,
                                                HttpServletResponse response,
                                                HttpMessageContext context)
            throws AuthenticationException {

        if (isLoginPasswordRequest(request)) {
            Credential credential = extractPasswordCredential(request);
            CredentialValidationResult result = identityStoreHandler.validate(credential);

            if (result.getStatus() != CredentialValidationResult.Status.VALID) {
                return context.responseUnauthorized();
            }

            if (mfaRequired(result)) {
                sessions.createPartialSession(result, request, response);
                return context.responseUnauthorized();
            }

            return context.notifyContainerAboutLogin(
                    result.getCallerPrincipal(),
                    result.getCallerGroups()
            );
        }

        return context.doNothing();
    }
}

@NameBinding
@Retention(RetentionPolicy.RUNTIME)
@Target({ElementType.TYPE, ElementType.METHOD})
public @interface RequiresStepUp {
    String value();
}

@Provider
@RequiresStepUp("CREATE_API_KEY")
public final class StepUpContainerRequestFilter implements ContainerRequestFilter {

    @Inject StepUpPolicyService policies;
    @Context SecurityContext securityContext;

    @Override
    public void filter(ContainerRequestContext requestContext) {
        if (!policies.currentSubjectSatisfies("CREATE_API_KEY", securityContext)) {
            throw new ForbiddenException("STEP_UP_REQUIRED");
        }
    }
}

public record RiskDecision(
        RiskLevel level,
        boolean requireMfa,
        boolean requirePhishingResistant,
        Set<String> allowedMethods,
        List<String> reasons
) {}

public RiskDecision evaluate(LoginContext ctx) {
    List<String> reasons = new ArrayList<>();
    int score = 0;

    if (ctx.newDevice()) {
        score += 30;
        reasons.add("new_device");
    }
    if (ctx.impossibleTravel()) {
        score += 50;
        reasons.add("impossible_travel");
    }
    if (ctx.accountRole().isAdmin()) {
        score += 40;
        reasons.add("admin_account");
    }
    if (ctx.recentPasswordReset()) {
        score += 25;
        reasons.add("recent_password_reset");
    }

    if (score >= 80) {
        return new RiskDecision(
                RiskLevel.HIGH,
                true,
                true,
                Set.of("webauthn", "hardware_key"),
                reasons
        );
    }

    if (score >= 30) {
        return new RiskDecision(
                RiskLevel.MEDIUM,
                true,
                false,
                Set.of("totp", "webauthn", "recovery_code"),
                reasons
        );
    }

    return new RiskDecision(RiskLevel.LOW, false, false, Set.of(), reasons);
}

Risk engine must be explainable enough for incident review.
Risk score must not become untestable magic.
Risk challenge must be observable.

public record StartChallengeCommand(
        UUID tenantId,
        UUID accountId,
        UUID authenticationSessionId,
        ChallengePurpose purpose,
        Set<String> allowedMethods,
        RiskDecision riskDecision,
        String ipAddress,
        String userAgent
) {}

public record ChallengeStarted(
        UUID challengeId,
        ChallengePurpose purpose,
        List<ChallengeOption> options,
        Instant expiresAt
) {}

POST /mfa/challenge
{ "method": "email_otp" }

POST /mfa/challenge
{ "requirementId": "create_api_key" }

To add MFA factor:
- require current password or current MFA
- create pending authenticator
- verify authenticator once
- activate authenticator
- notify user

To disable MFA factor:
- require fresh step-up with another factor
- disallow removing last strong factor unless recovery policy satisfied
- notify user
- audit event
- revoke trusted devices if risk high

public void disableAuthenticator(UUID accountId, UUID authenticatorId) {
    List<AccountAuthenticator> active = repo.findActive(accountId);

    AccountAuthenticator target = active.stream()
            .filter(a -> a.id().equals(authenticatorId))
            .findFirst()
            .orElseThrow(NotFoundException::new);

    long remainingStrong = active.stream()
            .filter(a -> !a.id().equals(authenticatorId))
            .filter(AccountAuthenticator::isStrongMfa)
            .count();

    if (target.isStrongMfa() && remainingStrong == 0) {
        throw new PolicyViolationException("Cannot remove last strong MFA factor");
    }

    repo.disable(authenticatorId, clock.instant());
    audit.authenticatorDisabled(accountId, authenticatorId, target.method());
}

Attacker has password.
Attacker triggers repeated push approvals.
User gets tired/confused.
User taps approve.

Login screen shows: 42
Mobile app asks: choose number shown on browser

{
  "iss": "https://idp.example.com",
  "sub": "248289761001",
  "aud": "regulatory-case-platform",
  "auth_time": 1783098831,
  "acr": "urn:example:aal2",
  "amr": ["pwd", "otp"]
}

create table idp_assurance_mapping (
    tenant_id uuid not null,
    issuer varchar(512) not null,
    acr varchar(256),
    amr_required jsonb not null,
    local_assurance varchar(64) not null,
    primary key (tenant_id, issuer, acr)
);

issuer=https://corp-idp.example.com
acr=urn:corp:aal2
amr contains [pwd, fido]
=> local assurance PHISHING_RESISTANT

Action request -> authorization check -> assurance check -> step-up -> action decision -> audit envelope

{
  "eventType": "TENANT_ADMIN_ROLE_ASSIGNED",
  "actorAccountId": "...",
  "targetAccountId": "...",
  "tenantId": "...",
  "authorizationDecisionId": "...",
  "authenticationEventId": "...",
  "assuranceLevel": "PHISHING_RESISTANT",
  "authMethods": ["pwd", "webauthn"],
  "freshAuthAgeSeconds": 84,
  "riskReasons": ["admin_action"],
  "ipAddress": "203.0.113.10",
  "userAgentHash": "...",
  "createdAt": "2026-07-03T10:00:00Z"
}

User signs in with MFA.
Malware/browser injection changes target action.
Server only knows MFA happened, not what user approved.

Challenge includes action details.
User approves that exact action.
Server binds proof to action payload hash.

create table step_up_authorization (
    id uuid primary key,
    tenant_id uuid not null,
    account_id uuid not null,
    action_type varchar(128) not null,
    action_hash bytea not null,
    challenge_id uuid not null,
    assurance_level varchar(64) not null,
    authorized_at timestamptz not null,
    expires_at timestamptz not null,
    consumed_at timestamptz
);

public byte[] actionHash(String actionType, Object canonicalPayload) {
    byte[] payload = canonicalJson.serialize(canonicalPayload);
    MessageDigest sha256 = MessageDigest.getInstance("SHA-256");
    sha256.update(actionType.getBytes(StandardCharsets.UTF_8));
    sha256.update((byte) 0);
    sha256.update(payload);
    return sha256.digest();
}

A step-up authorization is valid only for the action payload it was created for.

account_id
identifier_hash
ip / subnet
device_id
tenant_id
challenge_id
method
phone/email destination hash

rl:mfa:verify:tenant:{tenantId}:account:{accountId}
rl:mfa:verify:tenant:{tenantId}:ip:{ipHash}
rl:mfa:send:tenant:{tenantId}:dest:{destHash}
rl:mfa:push:tenant:{tenantId}:account:{accountId}

invalid OTP attempts > 5 per challenge => challenge locked
OTP send > 3 per 15m per destination => suppress send
MFA failures after valid password > threshold => require recovery or delay
push prompts > 3 per login => block and alert

auth_mfa_challenge_started_total{method,purpose,tenant}
auth_mfa_challenge_verified_total{method,purpose,tenant}
auth_mfa_challenge_failed_total{method,reason,tenant}
auth_mfa_recovery_code_used_total{tenant}
auth_mfa_step_up_required_total{action,tenant}
auth_mfa_step_up_completed_total{action,method,tenant}
auth_mfa_trusted_device_used_total{tenant}
auth_mfa_push_denied_total{tenant}
auth_mfa_delivery_failed_total{method,provider}

{
  "event": "mfa.challenge.failed",
  "tenantId": "...",
  "accountId": "...",
  "method": "totp",
  "purpose": "login",
  "reason": "invalid_code",
  "challengeId": "...",
  "ipHash": "...",
  "userAgentHash": "...",
  "riskLevel": "medium",
  "timestamp": "2026-07-03T10:10:00Z"
}

MFA verification failure spike by tenant
Push prompt storm for account
Recovery code use by admin
MFA disabled for tenant admin
High-risk action completed with weak assurance
Trusted-device use from impossible-travel location

No endpoint accepts PartialAuthenticationPrincipal except MFA endpoints.
No MFA code appears in logs.
No MFA secret appears in API response after enrollment screen.
No challenge can be verified after expiry.
No challenge from tenant A works in tenant B.
No step-up from action A authorizes action B.

Password correct creates full session.
MFA page is shown by UI only.
API does not enforce MFA server-side.

Do not create full session before MFA.
Or enforce partial-auth denylist/allowlist server-side.

Admin uses hardware key.
Support can disable MFA after email verification only.

Recovery assurance >= login assurance for high-risk accounts.

6-digit OTP with unlimited retries.

Challenge max attempts + account/IP/destination throttling + short TTL.

Push prompt repeatedly sent until user approves.

Number matching + prompt limit + report abuse + alert.

Remember device token valid forever and enough for admin actions.

Bounded lifetime + revocation + risk binding + never enough for high-risk action.

MFA challenge issued under tenant A accepted under tenant B.

Tenant id in every challenge, authenticator, session, and verification query.

User enrolled one authenticator. Device lost. No recovery path.

Require backup method/recovery codes during enrollment.

User performed MFA 12 hours ago; still allowed to change payout account.

Sensitive actions require max-age-bound assurance.

[ ] MFA methods are classified by assurance strength.
[ ] Partial authentication cannot access protected endpoints.
[ ] Challenge records are tenant-bound and session-bound.
[ ] OTP/recovery codes are never stored plaintext.
[ ] TOTP secrets are encrypted/protected.
[ ] Verification is rate-limited by account/IP/challenge/destination.
[ ] Recovery code is single-use and audited.
[ ] Recovery does not silently disable all MFA.
[ ] Trusted device token is random, hashed, expiring, revocable.
[ ] High-risk actions require fresh step-up.
[ ] Step-up evidence includes method and timestamp.
[ ] Sensitive step-up can be action-bound.
[ ] All MFA events are auditable.
[ ] MFA disable/add/change requires fresh verification.
[ ] Last strong factor cannot be removed accidentally.
[ ] Admin users require phishing-resistant MFA where feasible.
[ ] OAuth/OIDC acr/amr mapping is tenant-specific.
[ ] MFA secrets/codes/tokens are redacted from logs.
[ ] Incident runbook exists for authenticator compromise.

Did MFA happen?

Which subject was authenticated?
Which authenticator proved it?
At what time?
At what assurance level?
For what purpose?
Under what risk context?
Is that evidence sufficient for this action now?