Authentication's next era: From operating controls to orchestrating trust

For most of the last two decades, we told ourselves a comforting story about authentication: as long as we owned the controls, we owned the security. We set the password complexity. We defined the OTP rules and the retry limits. We ran the identity proofing. If we operated the levers, surely we were in control.

I've spent my career helping build modern credential approaches — the first passwordless FIDO specification, and a lot of the standards work since — and I want to be direct about something that took the industry too long to realize: that control story was never quite true. And the ground has now shifted far enough that continuing to believe this story is a strategic risk. 
 

The comfortable illusion 

The old model was what we call "over-the-top". Passwords, OTPs, and selfie+picture ID all worked independently of the underlying platform. That independence was genuinely useful. It gave us reach across every device and channel. But it came with a hidden cost as these mechanisms had no binding to the device, the app, or the context in which they were used.

Modern attacks drove straight through that crack. Phishing doesn't break your password policy, it bypasses it entirely, because the user is authenticating through a server the adversary controls. OTPs get relayed in real time, but SMS codes inherit every weakness of the mobile network underneath them. Deepfakes put selfie+picture ID methods at risk, and the open internet retired knowledge-based questions for identity verification years ago.

The uncomfortable lesson: Operating the controls is not the same as controlling trust. We were enforcing character sets while attackers walked around the whole scheme. 
 

Where control actually lives now 

Passkeys are only the first example of a broader shift. Digital credentials, identity wallets, and eventually delegated AI identities follow the same pattern: identity is becoming platform-mediated rather than application-controlled.

The operating system and browser mediate the use of the credentials. Apps invoke them through platform APIs. And that changes the physics of security in our favor.: The platform knows the identity of the app and the origin of the page, which is exactly what makes passkeys phishing-resistant. It has privileged access to sensors and secure hardware, which makes user verification and key protection far stronger than anything an over-the-top method could reach. And the user experience is simply better. 

There are already more than five billion passkeys in the field. This isn't a forecast; it's the current architecture. 

But here's the catch, and it's the part most organizations haven't fully absorbed.: You no longer operate many of the controls directly. The passkey provider, the wallet, the platform —– they are largely opaque to you. You see them through the narrow window of an official API. Instinctively, that feels like a loss of control. 

It isn't. It's a relocation of control. If your security strategy is still built around levers you personally pull, you are optimizing for a world that no longer exists. 

Document verification to credential verification: A practical example 

Consider a bank onboarding flow.

In the traditional model, a customer uploads a picture of an identity document and records a selfie. The bank then runs a series of controls:  

• Document authenticity checks,
• Face matching 
• Liveness detection, 
• Fraud checks 

In a digital credential model, the customer may instead present a government-issued identity credential directly from a wallet. The platform mediates the interaction. The wallet presents a cryptographically protected credential. The bank no longer needs to determine whether pixels in an image represent a genuine document. 

But a new question emerges: how much trust should the bank place in that credential? 

• Was it issued by a trusted authority? 
• Is it being presented from a trusted wallet?  
• Is the request coming from a healthy device?  
• Are there indications that a remote-access tool, bot, or adversary-in-the-middle attack is involved? 

This is a fundamentally different problem from traditional authentication. Password policies, OTP policies, and identity proofing controls are largely static. Trust evaluation is dynamic. It requires combining credential characteristics, wallet characteristics, platform characteristics, and contextual risk signals into a real-time decision. 

A bank may eventually receive credentials from multiple wallet ecosystems: government wallets, banking wallets, enterprise wallets, and consumer wallets. The challenge is no longer simply accepting a credential. The challenge is determining how much trust each credential, wallet, and platform combination deserves. 

The challenge shifts from validating documents to evaluating trust. 

The implication is profound. Authentication systems can no longer focus solely on validating credentials. They increasingly need to compare assurance levels across credential types, evaluate the trustworthiness of platforms and wallets, incorporate runtime risk signals, and transform all of that into a consistent decision. Identity becomes less about credential management and more about trust orchestration. 

And that's exactly the broader transition happening across authentication and identity.

What trust orchestration means for your organization 

This is the "so what," and it's where I'd focus attention if I were running identity for a bank, an insurer, or any enterprise serious about fraud. 

Your job shifts from defining credentials to evaluating them. You're no longer setting minimum password lengths. You're assessing which credential was used, which platform vouched for it, and whether the surrounding environment is trustworthy; and combining those into a decision at runtime.

Not all passkey providers, security keys, and wallets are created equal. A hardware security key and a passkey synced through a consumer credential manager carry very different assurance. Your authentication logic has to be credential-aware, or it's flying blind. 

Credential-aware means recognizing that a device-bound credential, a synced passkey, a government-issued digital credential, and a self-asserted credential are not equivalent sources of trust. They may provide very different levels of assurance and should not automatically receive the same treatment. 

Your app still needs self-defense against the residual risk. Platforms do a good job of reducing malware risk, but they don't eliminate it. Applications still need telemetry and self-protection capabilities that augment platform security and contribute additional trust signals. This applies equally to banking apps, credential managers, passkey providers, and identity wallets.

Your signals need a redesign, not a bigger pile. The old game was thousands of (often even correlated) device-fingerprinting signals, most of which collapse under adversary-in-the-middle attacks. The new game is fewer, stronger, less noisy signals that actually distinguish a human from a hostile bot, and increasingly, a legitimate delegated agent from an impersonator. 

In many ways, AI agents are simply the next step in the same transition. Passkeys moved authentication into platform-mediated credentials. Digital credentials moved identity assertions into platform-mediated wallets. AI agents move execution into platform-mediated software actors. Each step reduces the importance of directly controlling credentials and increases the importance of orchestrating trust. 

Today most agents simply impersonate the user, which does not scale securely. The question is shifting from "who logged in" to "who is acting, under whose authority, and within what constraints". Verifiable delegation is coming, and the organizations that already think in terms of orchestrating trust will absorb it far more easily than those still guarding credential policies. 

Winning in the next era of authentication 

If you take away a single idea, make it this: the winners in this next phase won't be the enterprises that operate fine-grained controls on credentials. They'll be the ones that orchestrate trust – dynamically, across every credential, platform, and signal in play. The sooner your architecture reflects that, the less the ground shifting underneath you will hurt.

Talk to an expert today on how to win in the next era of authentication.