Because passwordless only protects the login ceremony, not the identity proofing that happened before it. If the wrong person is enrolled, the system will authenticate them more reliably. Strong enrollment controls are what stop a better login method from validating a bad identity.
Why This Matters for Security Teams
passwordless authentication reduces phishing and password reuse risk, but it does not fix weak identity proofing. If enrollment is loose, the system will still bind a strong authenticator to the wrong person, which turns a better login method into a more reliable way to authenticate an impostor. That is why strong enrollment controls remain a core control plane issue, not a user convenience issue.
The problem is especially visible in modern identity stacks where recovery flows, help desk overrides, contractor onboarding, and delegated administration create alternate paths into the same account. Guidance from the NIST AI Risk Management Framework is not about passwordless specifically, but it reinforces the broader principle that trust must be established and maintained with strong process controls, not just with stronger authentication technology. NHIMG research on the Ultimate Guide to Non-Human Identities makes the same operational point for machine identities: the identity lifecycle matters as much as the credential itself.
In practice, many security teams discover enrollment weaknesses only after an account recovery case, reseller onboarding error, or help desk exception has already created a durable false identity.
How It Works in Practice
Strong enrollment control is about proving who or what is being bound to the authenticator before the first successful login. That usually means separating identity proofing, enrollment approval, and credential issuance into distinct steps with different trust requirements. A well-run programme validates government IDs or equivalent enterprise evidence, checks liveness where appropriate, confirms possession of the claimed device or key, and records who approved the binding decision.
For higher-risk populations, the best practice is evolving toward step-up proofing and just-in-time approval rather than one-time blanket onboarding. Current guidance suggests treating recovery paths as part of enrollment, because recovery is often the easiest way to bypass the original control. This is where policies from the OWASP Agentic AI Top 10 and CSA MAESTRO agentic AI threat modeling framework are useful beyond AI: they both stress that trust decisions should be explicit, contextual, and auditable.
- Require proofing evidence that matches the account risk tier.
- Use separate approval for privileged or high-impact enrollments.
- Bind the authenticator to a verified device, key, or workload identity.
- Log the full enrollment chain, including overrides and recovery actions.
- Review exception rates, because repeated exceptions usually signal process drift.
For machine or service identities, the same logic applies through workload identity, short-lived credentials, and cryptographic proof of possession. NHIMG’s AI Agents: The New Attack Surface report shows why this matters operationally: 80% of organisations report AI agents have already acted beyond their intended scope, which is a reminder that trust failures often begin before the first authenticated action. These controls tend to break down in high-volume onboarding environments because speed pressure pushes teams to collapse proofing, approval, and recovery into a single low-friction step.
Common Variations and Edge Cases
Tighter enrollment controls often increase friction and support cost, so organisations have to balance user experience against the risk of identity fraud and account takeover. That tradeoff becomes sharper for contractors, remote staff, seasonal users, and service accounts, where proofing evidence may be weaker or inconsistent. There is no universal standard for this yet, so current guidance suggests risk-tiered enrollment rather than one-size-fits-all requirements.
One edge case is passkey or authenticator migration. If an organisation lets users self-enrol new authenticators too easily, attackers who compromise email, device recovery, or a help desk workflow may silently replace a legitimate binding. Another is delegated administration, where an IT or HR operator enrolls users at scale. That can be efficient, but it creates a concentration risk if the operator identity or workflow is abused. The same caution appears in NHIMG’s OmniGPT breach analysis and the NIST AI 600-1 Generative AI Profile: operational shortcuts become attack paths when the trust boundary is too broad.
For privileged users, strong enrollment should also include separate attestation and periodic re-verification, because an authenticator can remain technically valid long after the underlying identity risk has changed. The safer rule is simple: passwordless should remove password risk, not remove identity assurance.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST SP 800-63 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 | Strong enrollment depends on binding the right identity to the authenticator. |
| NIST SP 800-63 | IAL/ AAL/ FAL | Enrollment quality is defined by identity proofing and authenticator binding assurance. |
| NIST CSF 2.0 | PR.AC-1 | Enrollment controls determine whether access is granted to the correct subject. |
Treat enrollment as an access-control control and audit all exceptions, overrides, and recovery events.
