Passwords use Argon2id and access tokens remain short-lived.
Evidence basis
Authentication service, configuration bounds and negative route tests.
Deliberate boundary
Secure password storage prevents neither phishing nor compromised endpoints.
All evidenceGRD-02 / Identity & access
How does Connect control identities and devices?
Which access and device controls exist today?
Connect combines memory-hard password hashing with short-lived access tokens, rotating refresh sessions, visible devices and targeted session revocation. FIDO2/WebAuthn credentials can be registered and used for authentication.
01
Refresh tokens rotate and reuse revokes the affected token family.
Evidence basis
Session logic and automated reuse/revocation tests.
Deliberate boundary
An already compromised unlocked endpoint remains a separate risk.
Devices, sessions, login history and passkeys are manageable security objects.
Evidence basis
WebAuthn routes, device/session endpoints and management interfaces.
Deliberate boundary
No tenant model, SSO or SCIM provisioning.
- Passkeys do not replace organisational policy or MDM.
- Device verification is not forensic endpoint integrity validation.
- The current pilot is not a complete zero-trust IAM system.
- 01How are invitations, role changes and departures approved?
- 02Which devices may participate and how quickly must they be revoked?
- 03Are SSO or SCIM mandatory before rollout?
Related primary pages
Short answers
Which access and device controls exist today?
Yes. The implementation includes FIDO2/WebAuthn registration, authentication and removal. This is not an external certification of the full authentication model.
Yes. Devices and related sessions can be revoked; the effect should also be exercised in the actual pilot environment.