AgentRules.org
RulesStacksClientsAuditorPrunerSelf-HealRFCsBenchmarkCLICI/CDAuthorsSubmit
This specification is maintained by the AgentRules Working Group. Have enhancements or want to claim maintainership?Submit Specification →
securitycritical PriorityID: webauthn-hardware-device-bound-attestation-barrier

Hardware-Backed Device-Bound Passkey Attestation Enforcement for Zero-Trust Boundaries

Enforces direct hardware-backed attestation and strict inspection of AuthenticatorData flags during WebAuthn credential registration. Prevents cloud-synchronized credentials (iCloud Keychain, Google Password Manager) from accessing zero-trust administrative perimeters by verifying physical device-bound roots of trust against certified FIDO Metadata Service (MDS3) roots.

Prohibited Anti-Pattern: Permitting Synced Multi-Device Passkeys (None Attestation / Unchecked Backup Flags) in Privileged Zero-Trust Workflows

Export Ready-to-Drop Configuration

Select format below to copy code or download file directly.

---
description: Hardware-Backed Device-Bound Passkey Attestation Enforcement for Zero-Trust Boundaries - Enforces direct hardware-backed attestation and strict inspection of AuthenticatorData flags during WebAuthn credential registration. Prevents cloud-synchronized credentials (iCloud Keychain, Google Password Manager) from accessing zero-trust administrative perimeters by verifying physical device-bound roots of trust against certified FIDO Metadata Service (MDS3) roots.
globs: src/auth/**/*.{ts,tsx}, src/server/auth/**/*.{ts,tsx}, **/webauthn/**/*.{ts,tsx}, **/fido2/**/*.{ts,tsx}, **/identity/**/*.{ts,tsx}
alwaysApply: true
verified_by: "agentrules.org"
license: "CC-BY-4.0"
source: "https://agentrules.org/rules/webauthn-hardware-device-bound-attestation-barrier"
---

# Hardware-Backed Device-Bound Passkey Attestation Enforcement for Zero-Trust Boundaries

> **Severity**: CRITICAL | **Category**: security
> **Anti-Pattern Warning**: Permitting Synced Multi-Device Passkeys (None Attestation / Unchecked Backup Flags) in Privileged Zero-Trust Workflows

## System Constraints
You are a Principal Security Architect enforcing Hardware-Backed WebAuthn Synced Passkey Attestation Barriers. You must reject any WebAuthn registration implementation for zero-trust/administrative scopes that accepts cloud-synchronized passkeys, fails to enforce direct hardware attestation, or omits verification of AuthenticatorData backup flags (BE/BS) and AAGUID allowlists.

## Strict Guidelines
- Engineers MUST ALWAYS set 'attestation: "direct"' (or "enterprise") and 'authenticatorSelection.userVerification = "required"' when generating registration options for administrative or zero-trust boundaries.
- Engineers MUST ALWAYS inspect AuthenticatorData flags during registration verification and explicitly REJECT credentials if 'flags.backupEligible' (BE) is true, preventing multi-device cloud synchronization.
- Engineers MUST validate the authenticator's AAGUID against an enterprise hardware token allowlist (e.g., FIPS-certified YubiKeys, Nitrokeys) or FIDO Alliance Metadata Service (MDS) v3 certified authenticators.
- Engineers MUST verify the x5c attestation certificate chain against trusted vendor intermediate and root CAs, ensuring validity and revocation status (OCSP/CRL).
- Engineers MUST NOT permit 'attestation: "none"' in registration options for privileged administrative authentication boundaries.
- Services MUST segregate passkey registration policies between consumer user profiles (synced passkeys permitted) and administrative/PAM profiles (hardware-bound tokens strictly mandated).

## Bad vs Good Implementations
### Verifying WebAuthn Passkey Registration for Zero-Trust Boundary

#### Bad Antipattern (AI Common Hallucination)
> **Why it fails**: The verification accepts any valid WebAuthn credential, including multi-device synced passkeys (iCloud Keychain, Google Password Manager). It fails to inspect authenticator flags (backupEligible) and fails to assert direct hardware root-of-trust (AAGUID and attestation certificate chain verification).
```typescript
import { verifyRegistrationResponse } from '@simplewebauthn/server';
import type { RegistrationResponseJSON } from '@simplewebauthn/types';

export async function verifyAdminPasskey(
  response: RegistrationResponseJSON,
  expectedChallenge: string,
  expectedOrigin: string,
  expectedRPID: string
) {
  // VULNERABLE: Allows multi-device synced passkeys into administrative boundaries
  // No check on backup eligibility (BE flag) or AAGUID hardware pedigree
  const verification = await verifyRegistrationResponse({
    response,
    expectedChallenge,
    expectedOrigin,
    expectedRPID,
    requireUserVerification: true,
  });

  if (!verification.verified || !verification.registrationInfo) {
    throw new Error('Registration failed');
  }

  return verification.registrationInfo;
}
```

#### Production Standard (Correct)
> **Standard**: Production invariant compliant implementation ensuring memory safety, deterministic execution, and zero runtime hallucination.
```typescript
import { verifyRegistrationResponse } from '@simplewebauthn/server';
import type { RegistrationResponseJSON } from '@simplewebauthn/types';

// Enterprise-approved hardware authenticators (e.g., YubiKey 5 FIPS series)
const ENTERPRISE_HARDWARE_AAGUIDS = new Set<string>([
  'ee882879-721c-4913-9775-3dfcce97072a', // YubiKey 5 Series
  '2fc0579f-8113-47ea-b116-bb5a8db9202a', // YubiKey 5 FIPS
  'c1c60334-1926-442a-9957-5582f80eb9dc', // Nitrokey 3
]);

export async function verifyAdminPasskey(
  response: RegistrationResponseJSON,
  expectedChallenge: string,
  expectedOrigin: string,
  expectedRPID: string
) {
  const verification = await verifyRegistrationResponse({
    response,
    expectedChallenge,
    expectedOrigin,
    expectedRPID,
    requireUserVerification: true,
  });

  if (!verification.verified || !verification.registrationInfo) {
    throw new Error('WebAuthn cryptographic verification failed');
  }

  const { credential, aaguid, attestationObject } = verification.registrationInfo;

  // INVARIANT 1: Strictly reject cloud-synchronized passkeys
  // Flags: Bit 3 = Backup Eligibility (BE), Bit 4 = Backup State (BS)
  const flags = credential.authenticatorDataFlags ?? attestationObject.flags;
  const isBackupEligible = flags ? (flags & 0x08) !== 0 : false;
  const isBackedUp = flags ? (flags & 0x10) !== 0 : false;

  if (isBackupEligible || isBackedUp) {
    throw new SecurityError('Credential must be device-bound. Multi-device synced passkeys are forbidden.');
  }

  // INVARIANT 2: Hardware Root-of-Trust verification via AAGUID
  if (!aaguid || !ENTERPRISE_HARDWARE_AAGUIDS.has(aaguid)) {
    throw new SecurityError(`AAGUID ${aaguid} is not authorized for zero-trust administrative boundaries.`);
  }

  return verification.registrationInfo;
}

class SecurityError extends Error {
  constructor(message: string) {
    super(message);
    this.name = 'SecurityError';
  }
}
```
Recommended MCP Servers (mcp-serverlist.com)

Equip agent with system tools to verify code for this stack.

FIDO Alliance MDS3 Inspector
Validates authenticator attestation certificates and AAGUIDs against the live FIDO Alliance Metadata Service v3 blob.
Recommended Agent Skills (askills.dev)

Ready-to-use executable skill functions tailored to this stack.

WebAuthn Security Auditor CLI
Inspects WebAuthn client options, server verification routines, and AuthenticatorData bitwise flag validation for security posture.
Architectural Specification & Invariant Rationale

Architectural Invariant Design: Hardware-Backed Device-Bound Passkey Attestation Enforcement for Zero-Trust Boundaries

Hardware-Backed Device-Bound Passkey Attestation Enforcement for Zero-Trust Boundaries defines an industrial-grade behavioral standard for security engineering. Enforces direct hardware-backed attestation and strict inspection of AuthenticatorData flags during WebAuthn credential registration. Prevents cloud-synchronized credentials (iCloud Keychain, Google Password Manager) from accessing zero-trust administrative perimeters by verifying physical device-bound roots of trust against certified FIDO Metadata Service (MDS3) roots. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Permitting Synced Multi-Device Passkeys (None Attestation / Unchecked Backup Flags) in Privileged Zero-Trust Workflows Without an explicit system instruction file, developers spend hours debugging silent failures.
Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure ModeAI Symptom (The Anti-Pattern)SeverityProduction Impact & Remedy
AI Hallucination & Deprecation DriftPermitting Synced Multi-Device Passkeys (None Attestation / Unchecked Backup Flags) in Privileged Zero-Trust WorkflowsCritical
Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production.
Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture InconsistencyAI assistants produce mixed paradigms across files, creating fragmented codebase conventions.Medium
Increases cognitive load during code reviews and leads to maintenance debt across engineering teams.
Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.
Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

1

Engineers MUST ALWAYS set 'attestation

Engineers MUST ALWAYS set 'attestation: "direct"' (or "enterprise") and 'authenticatorSelection.userVerification = "required"' when generating registration options for administrative or zero-trust boundaries.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
2

Engineers MUST ALWAYS inspect AuthenticatorData flags during registration verification and explicitly REJECT credentials if 'flags.backupEligible' (BE) is true, preventing multi-device cloud synchronization.

Engineers MUST ALWAYS inspect AuthenticatorData flags during registration verification and explicitly REJECT credentials if 'flags.backupEligible' (BE) is true, preventing multi-device cloud synchronization.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
3

Engineers MUST validate the authenticator's AAGUID against an enterprise hardware token allowlist (e.g., FIPS-certified YubiKeys, Nitrokeys) or FIDO Alliance Metadata Service (MDS) v3 certified authenticators.

Engineers MUST validate the authenticator's AAGUID against an enterprise hardware token allowlist (e.g., FIPS-certified YubiKeys, Nitrokeys) or FIDO Alliance Metadata Service (MDS) v3 certified authenticators.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
4

Engineers MUST verify the x5c attestation certificate chain against trusted vendor intermediate and root CAs, ensuring validity and revocation status (OCSP/CRL).

Engineers MUST verify the x5c attestation certificate chain against trusted vendor intermediate and root CAs, ensuring validity and revocation status (OCSP/CRL).

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
5

Engineers MUST NOT permit 'attestation

Engineers MUST NOT permit 'attestation: "none"' in registration options for privileged administrative authentication boundaries.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
6

Services MUST segregate passkey registration policies between consumer user profiles (synced passkeys permitted) and administrative/PAM profiles (hardware-bound tokens strictly mandated).

Services MUST segregate passkey registration policies between consumer user profiles (synced passkeys permitted) and administrative/PAM profiles (hardware-bound tokens strictly mandated).

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
Technical Questions & Answers

Frequently Asked Technical Questions

Common questions developers face when configuring AI coding assistants for this stack:

Q:Why is Hardware-Backed Device-Bound Passkey Attestation Enforcement for Zero-Trust Boundaries critical for AI coding assistants?

Enforces direct hardware-backed attestation and strict inspection of AuthenticatorData flags during WebAuthn credential registration. Prevents cloud-synchronized credentials (iCloud Keychain, Google Password Manager) from accessing zero-trust administrative perimeters by verifying physical device-bound roots of trust against certified FIDO Metadata Service (MDS3) roots. Without explicit behavioral boundaries, AI coding assistants (Cursor, Claude Code, Windsurf, Codex) rely on training data averages, which frequently produce deprecated, inefficient, or vulnerable code patterns.

Q:How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Permitting Synced Multi-Device Passkeys (None Attestation / Unchecked Backup Flags) in Privileged Zero-Trust Workflows) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q:Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q:Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

Open Specification · CC BY 4.0·Free for Personal, Team & Commercial In-Repo Use

Citation & Open Source Attribution Guidelines

This specification is licensed under Creative Commons Attribution 4.0 International (CC BY 4.0). You are completely free to adapt and share this rule in your workspace. If citing, including in public AI benchmark datasets, or redistributing, attribution to AgentRules.org is required.

Related SECURITY Rules

View all rules →
security
105

OpenFGA Graph Invariants: Cyclic Relation Prevention & Contextual Tuple Hardening

Enforces strict directed acyclic graph (DAG) topology validation during relationship mutation writes and mandates strict server-side schema verification for ephemeral contextual tuples in OpenFGA evaluations. Prohibits persistent storage of ephemeral request attributes and guards against recursive relation loops causing graph expansion denial-of-service.

security
81

WebAuthn Conditional UI Mediation, Nonce Atomicity, and Assertion Cryptographic Verification

Enforces zero-trust cryptographic validation for FIDO2/WebAuthn Passkey authentication with Conditional UI autofill. Requires atomic single-use challenge consumption to eliminate replay attacks, strict RP ID hash and origin binding, authenticatorData flag verification (User Presence and User Verification), and monotonic signature counter enforcement to detect authenticator cloning.

security
111

Enforce Sigstore Keyless OIDC Attestation and Admission Controller Verification

Enforces immutable supply-chain security using Sigstore Cosign keyless signing via ephemeral OIDC tokens issued by Fulcio and verified against the Rekor transparency log. Container workloads must be signed and attested at build time by digest, and admission controllers (such as Kyverno or Sigstore Policy Controller) must strictly validate the OIDC issuer and subject identity before allowing image execution.

1 Rule in Stack

Hardware-Backed