Capability Taxonomy

Lost-device and account reset flows that must balance usability with anti-fraud controls; attackers love recovery because it's the easiest path around strong login.

Credential stuffing detection, bot mitigation, signup abuse controls, and throttling; this is where authentication meets fraud engineering.

Centralized login via standards like OIDC and SAML to reduce credential sprawl; modern stacks trend OIDC-first but keep SAML where enterprise reality demands it.

The legacy baseline (username/password plus policies, breach checks, rate limits) that persists for compatibility; modern strategy is to harden it and reduce reliance on it rather than pretend it will disappear.

Phishing-resistant public-key sign-in where the server never receives a reusable secret; passkeys are becoming the default passwordless path for both consumer and workforce flows.

The umbrella for combining factors (have/know/are) to raise assurance; modern MFA focuses on strong factors and smart step-up to avoid "security theater" fatigue.

TOTP/HOTP and email/SMS codes; easy to deploy and still common, but increasingly treated as low assurance because of phishing and SIM-swap risk.

Push approvals to a bound device, often adding number matching or prompts to blunt push-spam attacks; strong UX when device binding is real and telemetry is good.

Security keys, smart cards, and platform authenticators that anchor authentication in hardware; this is the practical route to consistent phishing resistance.

Face/fingerprint/voice used mainly to unlock a locally stored credential rather than as a remote "biometric password"; done right, it improves UX without expanding biometric privacy risk.

Service-to-service identity using short-lived credentials, certificates, and workload identities instead of long-lived API keys; foundational for modern zero-trust architectures.

Dynamic decisions driven by signals like device posture, IP reputation, impossible travel, and behavior; powerful, but only as accurate as your telemetry and models.

Stronger checks for sensitive actions (payout changes, admin operations, high-value transactions), sometimes with explicit transaction signing to prevent "approved but different" fraud.

Token/session lifetimes, reauth rules, device binding, and continuous evaluation so trust can degrade mid-session when risk increases.

Permission catalogs, admin models, and role hierarchies that make authorization understandable and maintainable; it's old-school, but it's still the backbone of sane access design.

RBAC assigns permissions via roles tied to job function or tenancy; modern RBAC often adds constraints to avoid brittle over-privilege.

ABAC evaluates subject/resource/action/context attributes for more nuanced decisions; high power, high governance overhead if attributes aren't disciplined.

Central policies that express decisions at API/action/field/row levels; increasingly treated as a shared platform capability instead of app-by-app logic.

Graph-style permissions ("user is editor of project owned by org") that scale better for collaboration and multi-tenant SaaS than endless role permutations.

Standard delegated access using scopes and tokens; still the workhorse for modern APIs and third-party integrations.

A tightened "modern profile" that reflects how secure OAuth is deployed today, trimming risky legacy patterns and encouraging safer defaults.

Binding tokens to a client (e.g., mTLS/DPoP-style approaches), tightening refresh token handling, and enforcing modern client protections to reduce replay of stolen tokens.

Consent capture, scope design by purpose, re-consent, and revocation; especially important for consumer identity and regulated data sharing.

Safe support/admin impersonation, "on behalf of" delegation, and controls to prevent privilege escalation through helper workflows.

Near real-time revocation or session attenuation when a user is disabled, a device is compromised, or risk spikes; reduces the "wait for token expiry" security gap.

PDP/PEP patterns, API gateways, sidecars, service mesh enforcement, caching strategy, and latency tradeoffs; authorization becomes a distributed systems problem at scale.

Authorization between services using workload identity and service claims; critical in microservice and zero-trust environments.

Temporary elevation, approvals, and timeboxing so admins don't carry standing power; this is where least privilege stops being aspirational.

Structured definitions for evidence quality, validation steps, and binding strength so "high assurance" isn't just marketing language.

Detecting spoofing (photos, masks, replays, deepfakes) via passive/active checks; this is an arms race and requires continuous tuning and testing.

Matching selfie-to-ID or other biometric comparisons; strongest when paired with liveness and privacy-safe storage/processing practices.

Verifying a business's existence, registration status, and legitimacy across jurisdictions; usually more complex than KYC because business identity is messy and changes over time.

Establishing who ultimately owns or controls an entity; critical for AML programs and high-friction in practice because evidence is often fragmented.

Validating passports, driver's licenses, and national IDs using document forensics and issuer signals; increasingly shifts toward cryptographically verifiable mobile documents where ecosystems support them.

Cross-checking identity attributes against authoritative or trusted datasets to raise confidence and detect synthetic patterns.

Proving location/residency via documents and/or databases; often required for regulated services, taxation, and geo-eligibility constraints.

Email/phone verification and related risk checks; useful hygiene, but not sufficient as standalone "identity proofing."

Proving threshold attributes (like age) or eligibility without unnecessary identity exposure; a strong candidate for selective disclosure approaches.

Identity proofing for people, typically mixing documents, biometrics/liveness, and database checks; modern KYC tries to reduce repeated re-proofing while keeping assurance measurable.

Reverification triggers, periodic refresh, and monitoring to catch changes and emerging risk without re-running full onboarding every time.

Manual review queues, evidence handling, audit trails, appeals/disputes, and reviewer tooling; this is where verification programs succeed or fail.

Reusing cryptographically verifiable proofs to avoid repeated document capture and reduce friction, while still preserving measurable assurance.

Sanctions, PEP, adverse media, and risk scoring integrated into onboarding and periodic monitoring; more operational discipline than "one-time check."

Signals and models to detect coordinated abuse, synthetic identities, and deepfake-driven onboarding attempts; overlaps heavily with authentication risk engines.

The core representation of issuer-signed claims intended for independent verification; defines the issuer-holder-verifier mental model.

JWT/JSON-LD/COSE-style formats and proof types that trade off privacy, compatibility, and performance.

Managing definitions and versions so everyone agrees on what a credential "means," not just that it's signed.

Identifier schemes where the subject/controller can manage identifiers independently; commonly used to support portable identity and verifiable interactions.

The "how it works" for different DID ecosystems, including resolvers and registries; interoperability depends heavily on this plumbing.

Key generation, rotation, backup, and recovery models; in distributed identity, key management is the product, not an implementation detail.

Hybrid patterns that connect wallets/VCs with OIDC/SAML identity providers and enterprise assurance models; most deployments will be hybrid for years.

Proving specific attributes without revealing the entire credential; central to privacy-forward distributed identity.

Pairwise identifiers, minimal disclosure defaults, and correlation resistance so verifiers can't trivially stitch user activity together.

Interoperable issuance flows (authorization, issuance endpoints, holder binding) that let wallets obtain credentials across many issuers.

Standard request/response patterns for presenting claims, including verifier requests, holder consent, and replay protections.

DID-based or decentralized messaging patterns for exchanging credentials and coordinating protocols without central intermediaries.

Mechanisms to invalidate credentials and express current status without forcing verifiers to call issuers constantly.

Lists of trusted issuers/verifiers and governance rules that define who is allowed to participate and under what obligations.

Constrained "profiles" that narrow options (crypto suites, formats, metadata) so independent implementations actually interoperate at a defined assurance level.

QR, NFC, BLE, deep links, and cross-device handoffs; reliability under constraints (offline, mixed devices) is the real differentiator.

Browser/user-agent mediated credential presentation so websites can request credentials without bespoke integrations; a forward-looking path to mainstream adoption.

Profiles, test suites, and certifications that force consistent behavior; without this, standards remain theoretical.

Handling mobile driver's licenses and similar documents with defined reader interactions; critical for high-trust, real-world presentation.

Supporting remote/online presentation (not just proximity) so mdoc-style credentials can work for web and call-center use cases.

Hardware-backed key storage, secure UI patterns, tamper resistance, and device compromise defenses; if the wallet holds identity, the phone becomes part of your security boundary.

Non-custodial, custodial, and assisted recovery tradeoffs; the "right" model depends on whether you optimize for autonomy, recoverability, or centralized risk control.

Mechanisms to prove the wallet/device meets integrity expectations; useful for high assurance, but must be balanced against privacy and tracking risk.

Data-at-rest protection, backup strategy, metadata minimization, and compartmentalization; poor metadata handling can leak more than the credential itself.

Clear "what you're sharing" prompts, selective disclosure controls, and auditability; wallet UX is privacy enforcement, not just design polish.

Using wallet-held keys to approve sensitive actions and produce signatures with high non-repudiation; often the natural next step after credential adoption.

End-user apps/agents that store credentials and present proofs; success depends on security, interoperability, and clear consent UX.

Employee credentials for access, devices, and high-assurance workflows; typically needs lifecycle automation and admin governance.

Wallets anchored in formal trust frameworks and regulatory oversight; often designed for broad interoperability and offline/proximity use cases.

Capturing, updating, and proving user permissions and preferences across channels; useful only if enforcement is consistent downstream.

Ensuring identity attributes are used only for declared purposes; this is where privacy becomes an engineering constraint rather than a legal PDF.

Data localization, transfer rules, regional processing boundaries, and residency-aware policy enforcement for global platforms.

Selective disclosure, derived proofs, and ZK-style approaches that enable "prove X without sharing Y," especially useful for age/eligibility and regulated attributes.

Collecting the minimum required attributes, only when needed; lowers breach impact and often improves conversion.

Pairwise/scoped identifiers and aliasing to prevent easy cross-context correlation of user activity.

Measuring fraud and product performance without over-collecting identity-linked data; requires discipline in identifiers and aggregation.

DPIAs, control testing, vendor assessments, and evidence capture; best-in-class platforms expose privacy controls as configuration, not bespoke consulting.

Clear user disclosures and operator-facing rationales for automated decisions (risk scoring, denials, step-up) to build trust and reduce regulatory exposure.

DSAR workflows for access, deletion, correction, and portability; the hard part is identity resolution across systems.

Retention schedules, verified deletion, and "don't keep what you don't need" controls; the most effective privacy control is often simply not storing the data.

Delegated sharing with revocation and auditability, increasingly aligned with wallet-based "holder controls presentation" models.

Issuance, rotation, revocation, and retirement for passwords, passkeys, keys, certificates, and tokens; modern direction is short-lived and automated rotation wherever possible.

Service accounts, certificates, workload identities, and rotation; critical for cloud-native security posture.

Device registration, posture/compliance linkage, certificates, and device-bound credentials; essential for modern workforce security.

Signup/joiner flows, progressive profiling, and initial authenticator enrollment; the best designs minimize friction while still controlling risk.

Request/approve/grant/change/remove processes with audit trails; core to reducing standing access.

Managing admin identities, elevation workflows, and controlled break-glass; privileged lifecycle is where most governance failures become real incidents.

Detecting orphan accounts, permission drift, and mismatched attributes; unglamorous work that prevents breaches and audit failures.

Defining a canonical identity record, attribute sources of truth, and correlation rules; without this, lifecycle automation becomes guesswork.

Workforce directories and customer identity stores with schema management and sync; the "boring core" that keeps identity consistent.

Creating/updating/disabling accounts across apps and infrastructure; the goal is eliminating manual drift and orphaned access.

Creating accounts at first federated login to reduce admin overhead; it's fast, but dangerous if authorization and governance aren't tight.

Workforce lifecycle transitions with automation and approvals; traditional, proven, and still the most reliable mental model for enterprise access control.

Identity workflows as programmable processes (tickets, HR triggers, approvals, exceptions); identity platforms increasingly behave like workflow engines with security semantics.

Ingesting risk and lifecycle signals (user disabled, device compromised) to trigger revocation and access changes quickly.

Central governance for identities, roles, entitlements, and approvals; the discipline that prevents access from becoming tribal knowledge.

Periodic and event-driven reviews with evidence trails; the practical mechanism regulators and auditors expect.

Preventing toxic combinations of entitlements; effective SoD requires clean entitlement models and consistent enforcement.

Defining and owning a coherent permission catalog; traditional, slow work that pays off more than flashy tooling.

Managing sprawling cloud/SaaS permissions, right-sizing, and preventing over-privilege; this is a continuous process, not a quarterly project.

Governance overlay for PAM: timeboxing, approvals, admin role constraints, and session policies.

KPIs like phishing-resistant adoption, privileged timeboxing compliance, review completion quality, and incident reduction tied to identity controls.

Partner onboarding, metadata trust, key rotation rules, and operational trust agreements for federated identity ecosystems.

Rules for who can send/receive security events and what automated actions are allowed; powerful, but requires strict governance to avoid cascading mistakes.

Immutable logs, retention, queryability, and audit reporting; if you can't prove it, you don't really have the control.

Detecting identity-specific threats like token theft, suspicious consent, and privilege abuse, then responding with containment and revocation.

Version-controlled policies with review, testing, and staged rollout; the only scalable way to keep authorization logic from fragmenting.

Mapping controls to recognized assurance frameworks so "high assurance" has a concrete, auditable definition.

Vendor onboarding, scoped access, periodic review, and offboarding; frequently the weakest link in otherwise mature programs.