Account protection
Passkeys.
Review OAuth, passkeys, 2FA, sessions, login risk, recovery, and admin security controls from one protected workspace.
Passkey/WebAuthn contracts
Passkeys use registration and authentication challenges, credential ownership checks, monotonic counters, single-use challenge consumption, and step-up requirements before removal.