Managing MFA and Identity: Tri-State Logic

A compromised password should never result in compromised infrastructure. Relying solely on a username and password to secure a platform capable of wiping bare-metal servers or accessing cryptographic keys is negligent.

StateWarden enforces rigorous identity verification through our custom Multi-Factor Authentication (MFA) Engine. We utilize Time-based One-Time Passwords (TOTP) coupled with intelligent, context-aware execution policies.

1. Enforced Enrollment

StateWarden does not treat MFA as an "optional" feature for administrative accounts. Depending on your Realm's security posture, users may be forced to configure MFA immediately upon their first login before gaining access to the Dashboard.

The Setup Process

1. Users are presented with a cryptographic QR Code generated locally in their browser.
2. They scan the code using an industry-standard authenticator app (e.g., Google Authenticator, Authy, YubiKey).
3. Upon successful verification of the first token, StateWarden securely generates and displays 10 single-use Recovery Codes.

Critical: If a user loses their authenticator device, these Recovery Codes are their only mechanism for regaining access. StateWarden Support cannot bypass MFA for an account.

2. The Tri-State MFA Policy

We recognize that prompting an administrator for a 6-digit code every time they click a button causes alert fatigue and degrades the User Experience.

StateWarden solves this with Tri-State MFA Logic, configurable by the Realm Owner under the Security Settings.

State 1: OFF

• MFA is not globally enforced for Realm actions. (Note: Individual users may still have MFA enabled on their personal accounts for the initial login).
• Not recommended for production environments.

State 2: SMART (The "Detroit" Standard)

• Context-Aware Grace Period: When an administrator attempts a highly destructive or sensitive action (e.g., Deleting a Backup, Generating a BMR Token, Provisioning a Master Key), the StateWarden WebAPI issues a 403 Forbidden challenge.
• The Dashboard intercepts this challenge and prompts the user for their MFA code via our Intervention MFA modal.
• Upon success, the user is granted a 5-Minute Grace Period. They can perform subsequent critical actions within that window without being repeatedly challenged.

State 3: ALWAYS (Paranoia Mode)

• Zero grace period.
• Every single destructive or cryptographic action requires a fresh TOTP code, regardless of when the last code was provided.
• Designed for ultra-secure "air-gapped" mentalities or heavily audited operations.

3. Intervention MFA (Step-Up Authentication)

StateWarden's architecture assumes the frontend application is hostile ("Never Trust the Client").

When you configure your MFA Policy to SMART or ALWAYS, the decision logic resides entirely on the backend server.

1. The Dashboard attempts to execute DELETE /api/backups/{id}.
2. The backend evaluates the user's JWT token. It checks the mfa_at timestamp claim against the Realm's strict policy.
3. If the timestamp is missing or expired, the backend forcefully rejects the request.
4. The Dashboard catches the rejection, visually interrupts the user's workflow with a high-priority dialog, securely collects the TOTP code, negotiates a new "stepped-up" JWT token with the backend, and automatically retries the original deletion request.

This ensures seamless UX while maintaining mathematically unbroken backend enforcement.

StateWarden: Resilience Engineered.