A / Secure sign-inService · checking
Service secret

OpenID Connect / secret

Copy the secret now

The secret is shown only once. AuthGuard stores only a cryptographic digest; it will not show it again.

Service
Credential
New local proof

Passkey / WebAuthn

Add device

A recent ProofFlow or Presence session authorizes directly. The password only authorizes the account's first authenticator.

WebAuthn boundary. AuthGuard receives no biometrics or PIN; it receives the public key and signed responses.
Presence / new device

Pairing / five minutes

Pair authenticator

Create a disposable QR for the new device. The QR does not contain your session and is no longer accepted after this ceremony.

QRSingle-use secret · 256 bit
ValidityMaximum · 05:00
BiometricsAlways local
Local setup

Instance / bootstrap

First organization

The bootstrap token is only sent to the service and is never stored by the browser. A safe retry temporarily keeps only the idempotency key and a signature of the non-secret fields.

Use 15 to 1024 Unicode characters, for example a long, unique phrase. Spaces and accents are accepted; new passwords are normalized to NFC before secure derivation. The service rejects values known to be common or compromised, without contacting external services.
Sensitive change

Credential / revocation

Remove device

This device will no longer be able to authenticate the account.

Warning. The last passkey can only be removed after you confirm the recovery method. A recovery session only removes an authenticator if another one remains active.
Link received by email

Single use
Account security

Local confirmation + current password

Change password

Ends all sessions, including this one, and invalidates pending sign-ins. Devices, local biometrics and other factors are kept.

Use 15 to 1024 Unicode characters. Spaces and accents are accepted; new passwords are normalized to NFC before secure derivation. The server rejects common and predictable passwords.
Emergency access

Recovery / safe rotation

New codes

The current set stays active while you prepare and save the new one. It will only be replaced after your explicit confirmation.
Fallback / one-time code

TOTP / open standard

One-time code

A compatible generator can create standard codes. ProofFlow remains the primary proof and is required to enable, resynchronize or remove this fallback.

Different assurance. TOTP, HOTP and OCRA use a shared secret shown once; a passkey uses asymmetric cryptography. These classic factors do not satisfy PQ Required. None of these flows is, on its own, a Presence attestation.

StatusFetchingWaiting for the server.
Manage / Presence invitation

Invitation / PQ channel

Invite with Presence

The browser prepares only the email and the organization. Android confirms the Match, creates the identifiers and the secret locally and sends the request through the Presence session. No secret or authority passes through this QR.
Manage / new user

Identity / creation

Create user

Create only the access that is needed. The initial password must be delivered through a separate channel and replaced by ProofFlow at first sign-in.

Use 15 to 1024 Unicode characters, for example a long, unique phrase. Spaces and accents are accepted; new passwords are normalized to NFC before secure derivation. The service rejects values known to be common or compromised, without contacting external services.

Strong confirmation. This change requires a passkey or Presence with local verification less than five minutes ago. The server validates the session and the credential again. Status · confirmation requested on execution.
Manage / authentication records

User / Presence

Presence credentials

Credential records, not physical devices. This lookup does not attest online status, compliance or current PQ qualification. Biometric images, templates and results are not shown. Passkeys are not included in this view.
Manage / support

User / lost authenticators

Reset authenticators

Authenticators to revoke

All of this user's sessions and recovery codes are revoked. The enrollment code is shown only once.
Manage / transitional credentials

User / WebAuthn

Registered passkeys

Passkeys are transitional credentials, not Presence or proof of PQ support. Includes disabled records; does not identify physical devices. New records are not added to a lookup in progress. The status of each page is observed at the time it is read and is not a frozen history.
Manage / data subject rights

User / GDPR

Privacy

Each action requires recent confirmation and is recorded in the audit. Deletion is irreversible: it replaces the email, disables the account, revokes sessions and removes free text; the audit and signed receipts are pseudonymized.
Manage / sensitive change

User / access

Change access

  • Suspending revokes all of that user's sessions.
  • Demoting removes administrative access.
  • The last active administrative account cannot be suspended or demoted.

Recent ProofFlow. Confirmation requires a passkey or Presence with local verification less than five minutes ago, according to the server clock. Status · confirmation requested on execution.
Manage / limited authority

User / direct operation

Act on a known UUID

Use only an identifier obtained through an authorized channel. This operation does not confirm whether the user exists, nor does it reveal the email, role or current status.

No preview. Authorization is checked again in the same operation. Privileged identities and the last administrative account remain protected by the server.

Recent ProofFlow. The action requires recent local verification and is bound to the exact UUID and command. Status · confirmation requested on execution.
Recent confirmation

Session / confirmation

Confirm this change

Choose how to confirm that it is you. The session is replaced by a recent session; nothing is changed without this confirmation.
Third-party request

Decision / passkey

Review request

Comparison code—
Operate / revocation

Session / end access

Revoke session

The selected session loses access immediately. The ProofFlow credential is not removed.

Recent ProofFlow. This action requires a passkey or Presence with local verification less than five minutes ago. Status · confirmation requested on execution.
Operate / limited authority

Session / direct revocation

Revoke known UUID

Use only an identifier obtained through an authorized channel. The browser does not confirm the session's existence, owner or status before the operation.

Immediate revocation. If the UUID identifies the current session, the browser deletes the local authority after the server confirms.

Recent ProofFlow. The action requires recent local verification and is bound to the exact UUID. Status · confirmation requested on execution.
Manage / immutable revision

Policy / access

New revision

Edit only the versioned request below. The server validates and normalizes the closed language before computing the canonical digest; creating does not activate the revision.

Contract: schemaVersion, version and rules. Limit of 256 KiB, 256 rules and 32 conditions per rule.

New OIDC portal sign-in rule

Use the client_id from the OIDC registration, not the trade name or the portal address. The server requires it to match the request approved by Presence. Prefixes and wildcards are not accepted.

Choose groups by name or enter UUIDs directly. The lookup requires groups.read and only adds references to the draft. Belonging to one of the listed groups is enough. Empty: this rule does not restrict by group. Names, wildcards and repeated IDs are not accepted; the server checks current membership when authorizing.

Access schedules · UTC

The start is included and the end is excluded. UTC does not follow local daylight saving changes. An overnight period is split between the selected day and the next.

Start days · UTC

Only changes the draft, without activating the policy. Replacing or removing a schedule can broaden access and requires review. The other conditions are preserved. Rules with several AND schedules require explicit editing in the JSON.

This preview does not authorize access: it does not evaluate the other conditions or revoke sessions. The server uses its own time when issuing and consuming authorizations.

Authentication requirements

In ProofFlow authorizations, these filters use the proof validated for the operation: passkey or Presence. They do not change the organization's sign-in methods. A Presence approval can be the operation's proof even when the browser session started with a passkey.

New condition
One of these methods

Each condition is a filter of this rule, not a change to global MFA. Methods within the same condition are alternatives (OR); different conditions must all match together (AND). Removing or replacing can broaden access. Review the effect (allow, deny or request step-up) and the other rules.

Network zone conditions

The server classifies each connection by the verifiable network address and the organization's CIDRs. Public is a known connection with no match in the catalog; it does not mean access is allowed. Headers sent by the client do not define the zone. Without verifiable context, a policy with network conditions does not authorize access.

Alternative zones within this condition · OR

The rule's other conditions remain joined by AND. If there are several network conditions, select exactly the one you want to change; the editor does not merge them. Also review the rule's effect: allow, deny or request step-up.

Immutable. Once created, a revision cannot be changed or deleted. Status · confirmation requested on execution.
Manage / immutable revision

Policy / read

Review revision

Revision · —Immutable—

Created · —

Safe read. Always compare the digest shown with the rollout identity before preparing or promoting.
Manage / advisory lab

Policy / simulation

Test decision

Revision · —No authority—

Edit a synthetic context and observe the decision, reasons and matching rules produced by the same deterministic engine.

The tenant, schema and simulate mode are set by the server. This data is never accepted as proof of authentication, device, network or risk.
Manage / shadow observation

Rollout / no effects

Prepare candidate

Revision——

The candidate will be evaluated in parallel only for comparative evidence. It does not allow, deny or require factors in any operation.

Rollout state · —

Shadow only. Promotion is always a separate, confirmed action. Status · confirmation requested on execution.
Manage / sensitive transition

Rollout / confirmation

Confirm transition

Review the change before applying it.

Source
—
Target
—
Expected state
—

Authority change. The operation uses compare-and-swap and requires recent ProofFlow. If the state changes, nothing is applied.
Policies / Presence

Request prepared · awaiting confirmation

Continue on your phone

In Presence, choose “Ler pedido de política por QR” (scan policy request by QR) or “Importar pedido de política” (import policy request). Compare the Match and review the full command before authorizing.

The file contains the policy, but it contains no credentials and does not authorize changes. Share it only through the channel approved by the organization. It expires in five minutes; closing this window does not delete files already downloaded. The Match is public; it does not authenticate the sender.

After confirming in Presence, choose “Mostrar confirmação ao browser” (show confirmation to browser). This window accepts only the visual confirmation of this still-valid request. An uncertain result does not allow the change to be repeated.

The confirmation is bound to the visual channel; it does not authenticate the server. Anyone who obtains the request file can forge it; do not use it as audit proof. It does not change permissions, versions or state in this console.
Manage / group

Organization / authorization context

New group

Up to 64 lowercase letters without accents, numbers, dots, hyphens or underscores. The name stays reserved even when the group is archived.

Up to 512 Unicode characters. Do not include sensitive data.

Changes require recent local confirmation. In production, the server requires Presence; a classic passkey does not replace that authorization.
Account / local tracking

Operations / result

Confirm without retrying

These identifiers let you check the result of your management requests, even after signing in again. We do not store passwords, profiles or tokens in this tracking record.

An unknown result does not mean failure or cancellation. Checking never repeats the change. The record belongs to this browser; clearing the site data may delete it.