Review a privileged change
This gate authorizes the reviewed security workflow. CI verifies the passkey proof independently and reports the actual result.
Set up the security root
Use the private enrollment secret from AWS to enroll the first security passkey. Keep the secret out of chat and screenshots.
After both keys are enrolled, sign in with each and test cancellation. The security owner then seals the root through the reviewed bootstrap.
Security root
Change to review
Service maintenance preserves the accepted runtime permissions. The proposed Funcspace permissions remain separately held.