Topic starter
11/08/2026 3:13 pm
TL;DR: Authentication is shifting from operating fixed controls like passwords and OTPs to orchestrating trust across platform-mediated credentials, wallets, and runtime signals, according to OneSpan. That matters because passkeys, digital credentials, and delegated AI identities change where trust is evaluated, not just how users sign in.
Editorial analysis by NHI Mgmt Group, based on content published by OneSpan: “Authentication's next era: From operating controls to orchestrating trust”.
Key questions
Q: How should IAM teams adapt authentication when passkeys and wallets mediate trust?
A: IAM teams should move from factor-centric policy to assurance-based decisioning.
Q: Why do over-the-top authentication methods fail against phishing and relay attacks?
A: They fail because the attacker can bypass the method rather than break it.
Q: What breaks when authentication and authorization are treated as the same control?
A: Teams lose visibility into whether the real problem is identity proof or permission scope.
Practitioner guidance
- Redesign authentication policy around assurance tiers Classify credential types by assurance level, including device-bound security keys, synced passkeys, wallets and self-asserted credentials.
- Inventory where trust is actually evaluated Map whether the browser, operating system, wallet, app or identity provider is making the trust decision, then identify where the current programme still assumes direct control.
- Reduce dependence on noisy device fingerprinting Replace brittle fingerprint collections with fewer signals that better distinguish a legitimate user from a hostile bot, adversary-in-the-middle flow or delegated actor.
Bottom line: Authentication is moving toward runtime trust decisions that combine credential type, platform mediation and contextual signals.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/08/2026 3:27 pm
Trust orchestration is replacing control ownership as the real authentication problem. Authentication teams used to optimise policies they directly operated, but that model assumes the control surface sits inside the application boundary. Once passkeys, wallets and platform APIs mediate the decision, the real task becomes deciding how much trust to assign to a presented credential and its execution context. Practitioners should read this as a governance shift, not a UI refresh.
A question worth separating out:
Q: What is the difference between credential verification and trust orchestration?
A: Credential verification asks whether the presented factor is valid. Trust orchestration asks how much confidence the organisation should place in that credential, the platform presenting it and the surrounding runtime signals before granting access. The first is a validation step; the second is a decision model.
👉 Read our full editorial: Authentication is moving from control ownership to trust orchestration