Endpoint security

Combine GrayPass action binding and proof verification with your application's browser, device, and transaction controls. This guide explains where each control applies and how to handle a suspected endpoint compromise.

What an attacker can control

The browser is the collection environment. Code with page privileges can access session signing material, construct feature windows, and change the visible interface. Device management, extension policy, application dependency review, and browser security controls address this layer.

GrayPass authenticates evidence to its session and checks replay, ordering, and numerical validity. The device_integrity claim has status unsupported; limitation.compromised_endpoint_not_detectable identifies the endpoint trust assumption in the Assurance Profile. Use the profile together with your device controls.

What action binding provides

Your backend saves an exact pending operation before requesting authorization. A proof binds the subject, action, resource, context, audience, actor where applicable, and nonce. At execution, compare its hash with the saved request and execute the stored values.

Include every consequential field, such as the destination fingerprint and amount. This lets the verifier detect substitution after the request is bound. To establish what the person reviewed before authorization, supply the saved intent through the transaction-confirmation path appropriate to your application.

What passkeys provide

An action-bound passkey challenge verifies the authenticator response and required user verification for the ceremony. Display the saved transaction details in your application before invoking the passkey prompt. For operations requiring a trusted transaction display, add an independent review or confirmation channel.

The sandbox's labeled confirmation control exercises the integration chain. Use a registered passkey for the authenticator ceremony described in Decisions and challenges.

Design for independent controls

Keep account authentication, application permissions, device controls, and transaction-risk checks in your integration. Add a second reviewer, execution delay, limits, or an independent confirmation channel where the operation requires them.

Route hold decisions to an authorized reviewer with the saved request and an independent basis for approval. Set evidence freshness and proof lifetimes for the operation's risk and expected duration.

Incident response

1. Pause the pending operation and invalidate the affected application session.
2. Revoke the relevant GrayPass subject or credential.
3. Preserve the trace, timestamp, and required investigation records under your retention policy.
4. Complete account recovery through your trusted channel before re-enrollment.
5. Request a fresh authorization for the saved business intent when the account is ready.

Follow Security for credential handling and Enrollment and recovery for the recovery sequence.