Security Authentication

Overview

Use this skill to design and review authentication flows that resist account takeover while preserving acceptable user friction.

Scope Boundaries

• Authentication factors, login flows, or account-recovery behavior are being introduced or changed.
• Session management (cookie/token TTL, refresh policy, revocation) needs to be defined.
• Risk-based controls (MFA, step-up auth, suspicious login handling) are required.

Templates And Assets

• Authentication assurance matrix:
  • assets/auth-assurance-matrix-template.md

Inputs To Gather

• Identity sources and trust level requirements (internal users, external users, federated identities).
• Threat assumptions (credential stuffing, phishing, token theft, session hijacking).
• Regulatory and product constraints (MFA mandates, session timeout policy, UX limits).
• Operational constraints (IdP availability, incident response expectations, observability baseline).