Sessions, MFA and step-up

Every sign-in is decided by the identity.authenticate policy point and recorded as a session: the factors used, the authenticator assurance level (AAL) they reach, the device, the network, the risk.

Assurance levels

Adaptive sign-in

The built-in policy asks for a second factor when one is enrolled, when risk is high, when the network matches threat intelligence, or when the resource needs a higher AAL. Publish your own identity.authenticate policy to deny, step up or require approval on any fact: aal, factors, mfa.enrolled, risk.score, device.known, device.trust, threat_match, country, channel.

Step-up

A step-up is recorded as an elevation with its own expiry (12 hours by default). When it expires the session returns to the level its sign-in earned.

Continuous risk

When a person's risk changes, their sessions in your organization are re-evaluated by the session.risk point: by default 80+ requires a new step-up and 95+ ends the session.

API and MCP

GET  /api/v1/sessions                 (session:read)
GET  /api/v1/sessions/{id}
POST /api/v1/sessions/{id}/revoke     (security:respond)
POST /api/v1/auth-decisions           (access:decide, simulation)

MCP: authpermit_session_list, authpermit_session_revoke (high risk: waits for human approval).

Recovery codes

Ten single-use codes, generated from Settings → Security once an authenticator or passkey is enrolled and the session has stepped up. Stored only as keyed hashes.