IAM owns policy, PAM owns privileged account controls, and help-desk or identity operations owns recovery and issuance. The accountability model should be explicit because phishing-resistant authentication crosses enrolment, lifecycle, support, and audit boundaries. If ownership is split informally, exceptions and fallback paths will erode assurance over time.
Why This Matters for Security Teams
Hardware-backed passkeys are often described as phishing-resistant, but accountability is what determines whether they remain trustworthy after rollout. When ownership is unclear, organisations usually see gaps in enrolment standards, exception handling, recovery approval, and audit evidence. That matters because passkeys sit across IAM policy, privileged access workflows, and service desk operations, which means a single weak handoff can undo the security benefit. NIST’s Cybersecurity Framework 2.0 treats governance as an operating discipline, not a one-time control decision, and the same principle applies here.NHIMG’s Ultimate Guide to NHIs — Regulatory and Audit Perspectives reinforces that lifecycle ownership and evidence trails are what auditors examine when identity controls cross team boundaries. The practical risk is not just weak authentication, but uncontrolled exceptions that become permanent paths around policy. In practice, many security teams discover passkey drift only after recovery misuse, unenforced exemptions, or inconsistent device binding has already reduced assurance.
How It Works in Practice
Clear accountability starts with separating policy ownership from operational execution. IAM should define the passkey standard: who can use hardware-backed authenticators, what device assurance is required, how enrollment is verified, and what conditions allow fallback. PAM should own the privileged use case, especially where passkeys protect admin, break-glass, or sensitive operational access. Help-desk or identity operations should own issuance, recovery, and lifecycle support, because those are the steps most likely to introduce identity proofing errors if they are not tightly governed.In practice, effective governance usually includes three layers:
- Policy and risk decisions owned by IAM, with standards documented and reviewed regularly.
- Privileged account enforcement owned by PAM, including step-up rules, session visibility, and emergency access limits.
- Operational recovery owned by identity operations, with strict verification, ticket evidence, and revocation on device loss.
That operating model should be backed by evidence from lifecycle controls, as outlined in NHIMG’s Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs. NIST SP 800-53 Rev. 5 is useful here because it pushes teams toward accountable access administration, authentication, and auditability rather than informal delegation. Hardware-backed passkeys also need explicit exception handling: if a user loses the device, the recovery path must be short, verified, logged, and approved by the right function, not improvised by whoever answers the ticket.
Where organisations get this right, passkey governance is treated as a control system, not a project. The accountable owner can answer who approves enrollment, who can override it, who can revoke it, and who reviews the exceptions. These controls tend to break down when recovery is decentralised across multiple help-desk tiers because verification steps become inconsistent and exceptions stop being temporary.
Common Variations and Edge Cases
Tighter passkey governance often increases operational friction, requiring organisations to balance phishing resistance against user support speed and business continuity.There is no universal standard for this yet, but current guidance suggests the accountable model should change with risk tier. For standard workforce access, IAM may own policy while identity operations executes issuance and recovery. For administrators, PAM should also set stronger rules for device binding, session restrictions, and emergency access approval. For contractors or federated users, accountability may need to extend to the sponsoring business unit because onboarding and offboarding obligations are shared.
One common edge case is break-glass access. That path should not become a parallel authentication program. It needs a separate owner, separate approval, and post-use review. Another edge case is shared devices or kiosk-style environments, where hardware-backed passkeys may be technically possible but operationally awkward; the organisation should document whether they are allowed and under what assurance level. NHIMG’s Top 10 NHI Issues is a useful reminder that weak governance often appears first as unmanaged exceptions, not as a headline breach. The right model is explicit accountability, not consensus by committee.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-63 and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.OV | Passkey accountability is a governance and oversight issue. |
| NIST SP 800-63 | AAL | Passkeys support phishing-resistant authentication assurance levels. |
| OWASP Non-Human Identity Top 10 | NHI-01 | Unclear lifecycle ownership creates insecure identity and credential handling. |
| NIST AI RMF | Governance and accountability are central to trustworthy identity operations. |
Map passkey use to the required assurance level and verify recovery does not weaken it.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 26, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
