AgentRules.org
RulesStacksClientsAuditorPrunerSelf-HealRFCsBenchmarkCLICI/CDAuthorsSubmit
This specification is maintained by the AgentRules Working Group. Have enhancements or want to claim maintainership?Submit Specification →
securitycritical PriorityID: fido2-enterprise-attestation-passkey-rejection

FIDO2 Enterprise Attestation and Cloud-Syncable Passkey Rejection Guardrail

Enforces hardware-bound, non-exportable cryptographic authenticator validation via WebAuthn enterprise attestation statements to block personal consumer cloud credential synchronization on corporate assets. Mandates inspection of authenticator data flags to reject multi-device credentials (BE=1, BS=1) and validates authenticator AAGUIDs against enterprise-approved hardware allowlists anchored to FIDO MDS3 or private PKI.

Prohibited Anti-Pattern: Accepting Multi-Device Syncable Passkeys (BE=1) or Permitting 'none' Attestation in Enterprise Workflows

Export Ready-to-Drop Configuration

Select format below to copy code or download file directly.

---
description: FIDO2 Enterprise Attestation and Cloud-Syncable Passkey Rejection Guardrail - Enforces hardware-bound, non-exportable cryptographic authenticator validation via WebAuthn enterprise attestation statements to block personal consumer cloud credential synchronization on corporate assets. Mandates inspection of authenticator data flags to reject multi-device credentials (BE=1, BS=1) and validates authenticator AAGUIDs against enterprise-approved hardware allowlists anchored to FIDO MDS3 or private PKI.
globs: src/**/auth/**/*.{ts,tsx}, src/**/webauthn/**/*.{ts,tsx}, server/**/auth/**/*.{ts,js}, packages/**/security/**/*.{ts,tsx}
alwaysApply: true
verified_by: "agentrules.org"
license: "CC-BY-4.0"
source: "https://agentrules.org/rules/fido2-enterprise-attestation-passkey-rejection"
---

# FIDO2 Enterprise Attestation and Cloud-Syncable Passkey Rejection Guardrail

> **Severity**: CRITICAL | **Category**: security
> **Anti-Pattern Warning**: Accepting Multi-Device Syncable Passkeys (BE=1) or Permitting 'none' Attestation in Enterprise Workflows

## System Constraints
You are a Principal Security Architect and Cryptographic Engineer enforcing FIDO2 Enterprise Attestation and Hardware-Bound Non-Exportable Authenticator verification. You must prohibit consumer multi-device syncable passkeys (e.g., iCloud Keychain, Google Password Manager) and enforce strict AAGUID verification, attestation certificate path validation via FIDO MDS3, and direct inspection of Authenticator Data flags (BE/BS bits).

## Strict Guidelines
- Engineers MUST ALWAYS specify `attestation: 'enterprise'` in `PublicKeyCredentialCreationOptions` for enterprise credential enrollment.
- Engineers MUST ALWAYS enforce `authenticatorSelection: { authenticatorAttachment: 'cross-platform', userVerification: 'required', residentKey: 'required' }` to mandate dedicated security keys.
- Services MUST verify Authenticator Data flags and strictly reject credentials where Backup Eligibility (`flags.be` or bit 3) is true or Backup State (`flags.bs` or bit 4) is true.
- Services MUST extract the Authenticator Attestation GUID (AAGUID) and reject credentials whose AAGUID is not present on the enterprise-approved hardware allowlist or whose AAGUID is all zeros (`00000000-0000-0000-0000-000000000000`).
- Services MUST reject attestation statements with format `none` or self-attestation; valid statements MUST resolve to verifiable X.509 chains (`x5c`) anchored to corporate Enterprise PKI or FIDO Alliance MDS3 roots.

## Bad vs Good Implementations
### Insecure Passkey Registration vs. Hardware-Bound Enterprise Attestation Enforcement

#### Bad Antipattern (AI Common Hallucination)
> **Why it fails**: The registration options do not enforce enterprise attestation, permitting 'none' attestation statements. The verification bypasses user verification requirements, does not check Authenticator Data flags (BE/BS), and accepts consumer cloud-synced passkeys that export private keys across unmanaged personal devices.
```typescript
import { verifyRegistrationResponse } from '@simplewebauthn/server';

export async function registerDevice(user: any, body: any) {
  // ANTI-PATTERN: Accepts default syncable passkeys, allows 'none' attestation,
  // and fails to inspect authenticator backup flags (BE/BS) or AAGUID.
  const verification = await verifyRegistrationResponse({
    response: body,
    expectedChallenge: user.currentChallenge,
    expectedOrigin: 'https://corporate.internal',
    expectedRPID: 'corporate.internal',
    requireUserVerification: false,
  });

  if (verification.verified && verification.registrationInfo) {
    // Vulnerable: Syncable passkey (iCloud, 1Password, Google) saved to DB
    await saveCredential(user.id, verification.registrationInfo);
  }
}
```

#### Production Standard (Correct)
> **Standard**: Enforces user verification, extracts and inspects the authenticator data flags to reject backup-eligible and backed-up credentials (cloud-syncable passkeys), rejects format 'none', and strictly validates the AAGUID against an approved enterprise hardware token allowlist.
```typescript
import { verifyRegistrationResponse } from '@simplewebauthn/server';

const ENTERPRISE_APPROVED_AAGUIDS = new Set<string>([
  'cb69481e-8ff7-4039-93ec-0a2729a1d67b', // YubiKey 5 Series NFC (Enterprise)
  '2fc0579f-8113-47ea-b116-bb5a8db9202a', // Feitian BioPass FIDO2
]);

export async function registerEnterpriseHardwareToken(user: any, body: any) {
  const verification = await verifyRegistrationResponse({
    response: body,
    expectedChallenge: user.currentChallenge,
    expectedOrigin: 'https://corporate.internal',
    expectedRPID: 'corporate.internal',
    requireUserVerification: true,
  });

  if (!verification.verified || !verification.registrationInfo) {
    throw new SecurityError('Registration cryptographic verification failed');
  }

  const { aaguid, flags, attestationObject } = verification.registrationInfo;

  // INVARIANT: Reject Cloud-Syncable Passkeys via Authenticator Data flags
  // Bit 3: Backup Eligibility (BE), Bit 4: Backup State (BS)
  const isBackupEligible = flags.backupEligible ?? Boolean(flags & 0x08);
  const isBackedUp = flags.backedUp ?? Boolean(flags & 0x10);
  if (isBackupEligible || isBackedUp) {
    throw new SecurityError('Multi-device cloud-syncable passkeys are prohibited on corporate assets');
  }

  // INVARIANT: Strict AAGUID Allowlist Enforcement
  if (!ENTERPRISE_APPROVED_AAGUIDS.has(aaguid)) {
    throw new SecurityError(`Unauthorized Authenticator AAGUID: ${aaguid}`);
  }

  // INVARIANT: Enterprise Attestation Format Validation (no self-attestation or 'none')
  const { fmt } = attestationObject;
  if (fmt === 'none') {
    throw new SecurityError('Enterprise attestation format is required; none received');
  }

  await saveCredential(user.id, verification.registrationInfo);
}
```
Recommended MCP Servers (mcp-serverlist.com)

Equip agent with system tools to verify code for this stack.

FIDO Alliance MDS3 Inspector
Validates authenticator attestation certificates and metadata against the FIDO Alliance Metadata Service (MDS3).
Recommended Agent Skills (askills.dev)

Ready-to-use executable skill functions tailored to this stack.

WebAuthn ASN.1 & X.509 Chain Verifier
Inspects and verifies ASN.1 DER-encoded WebAuthn attestation certificates and flags via OpenSSL and cryptographic primitives.
Architectural Specification & Invariant Rationale

Architectural Invariant Design: FIDO2 Enterprise Attestation and Cloud-Syncable Passkey Rejection Guardrail

FIDO2 Enterprise Attestation and Cloud-Syncable Passkey Rejection Guardrail defines an industrial-grade behavioral standard for security engineering. Enforces hardware-bound, non-exportable cryptographic authenticator validation via WebAuthn enterprise attestation statements to block personal consumer cloud credential synchronization on corporate assets. Mandates inspection of authenticator data flags to reject multi-device credentials (BE=1, BS=1) and validates authenticator AAGUIDs against enterprise-approved hardware allowlists anchored to FIDO MDS3 or private PKI. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Accepting Multi-Device Syncable Passkeys (BE=1) or Permitting 'none' Attestation in Enterprise Workflows Without an explicit system instruction file, developers spend hours debugging silent failures.
Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure ModeAI Symptom (The Anti-Pattern)SeverityProduction Impact & Remedy
AI Hallucination & Deprecation DriftAccepting Multi-Device Syncable Passkeys (BE=1) or Permitting 'none' Attestation in Enterprise WorkflowsCritical
Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production.
Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture InconsistencyAI assistants produce mixed paradigms across files, creating fragmented codebase conventions.Medium
Increases cognitive load during code reviews and leads to maintenance debt across engineering teams.
Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.
Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

1

Engineers MUST ALWAYS specify `attestation

Engineers MUST ALWAYS specify `attestation: 'enterprise'` in `PublicKeyCredentialCreationOptions` for enterprise credential enrollment.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
2

Engineers MUST ALWAYS enforce `authenticatorSelection

Engineers MUST ALWAYS enforce `authenticatorSelection: { authenticatorAttachment: 'cross-platform', userVerification: 'required', residentKey: 'required' }` to mandate dedicated security keys.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
3

Services MUST verify Authenticator Data flags and strictly reject credentials where Backup Eligibility (`flags.be` or bit 3) is true or Backup State (`flags.bs` or bit 4) is true.

Services MUST verify Authenticator Data flags and strictly reject credentials where Backup Eligibility (`flags.be` or bit 3) is true or Backup State (`flags.bs` or bit 4) is true.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
4

Services MUST extract the Authenticator Attestation GUID (AAGUID) and reject credentials whose AAGUID is not present on the enterprise-approved hardware allowlist or whose AAGUID is all zeros (`00000000-0000-0000-0000-000000000000`).

Services MUST extract the Authenticator Attestation GUID (AAGUID) and reject credentials whose AAGUID is not present on the enterprise-approved hardware allowlist or whose AAGUID is all zeros (`00000000-0000-0000-0000-000000000000`).

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
5

Services MUST reject attestation statements with format `none` or self-attestation

Services MUST reject attestation statements with format `none` or self-attestation; valid statements MUST resolve to verifiable X.509 chains (`x5c`) anchored to corporate Enterprise PKI or FIDO Alliance MDS3 roots.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
Technical Questions & Answers

Frequently Asked Technical Questions

Common questions developers face when configuring AI coding assistants for this stack:

Q:Why is FIDO2 Enterprise Attestation and Cloud-Syncable Passkey Rejection Guardrail critical for AI coding assistants?

Enforces hardware-bound, non-exportable cryptographic authenticator validation via WebAuthn enterprise attestation statements to block personal consumer cloud credential synchronization on corporate assets. Mandates inspection of authenticator data flags to reject multi-device credentials (BE=1, BS=1) and validates authenticator AAGUIDs against enterprise-approved hardware allowlists anchored to FIDO MDS3 or private PKI. Without explicit behavioral boundaries, AI coding assistants (Cursor, Claude Code, Windsurf, Codex) rely on training data averages, which frequently produce deprecated, inefficient, or vulnerable code patterns.

Q:How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Accepting Multi-Device Syncable Passkeys (BE=1) or Permitting 'none' Attestation in Enterprise Workflows) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q:Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q:Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

Open Specification · CC BY 4.0·Free for Personal, Team & Commercial In-Repo Use

Citation & Open Source Attribution Guidelines

This specification is licensed under Creative Commons Attribution 4.0 International (CC BY 4.0). You are completely free to adapt and share this rule in your workspace. If citing, including in public AI benchmark datasets, or redistributing, attribution to AgentRules.org is required.

Related SECURITY Rules

View all rules →
security
105

OpenFGA Graph Invariants: Cyclic Relation Prevention & Contextual Tuple Hardening

Enforces strict directed acyclic graph (DAG) topology validation during relationship mutation writes and mandates strict server-side schema verification for ephemeral contextual tuples in OpenFGA evaluations. Prohibits persistent storage of ephemeral request attributes and guards against recursive relation loops causing graph expansion denial-of-service.

security
81

WebAuthn Conditional UI Mediation, Nonce Atomicity, and Assertion Cryptographic Verification

Enforces zero-trust cryptographic validation for FIDO2/WebAuthn Passkey authentication with Conditional UI autofill. Requires atomic single-use challenge consumption to eliminate replay attacks, strict RP ID hash and origin binding, authenticatorData flag verification (User Presence and User Verification), and monotonic signature counter enforcement to detect authenticator cloning.

security
111

Enforce Sigstore Keyless OIDC Attestation and Admission Controller Verification

Enforces immutable supply-chain security using Sigstore Cosign keyless signing via ephemeral OIDC tokens issued by Fulcio and verified against the Rekor transparency log. Container workloads must be signed and attested at build time by digest, and admission controllers (such as Kyverno or Sigstore Policy Controller) must strictly validate the OIDC issuer and subject identity before allowing image execution.

1 Rule in Stack

FIDO2