# ScrambleID: llms.txt

> This file helps AI engines (ChatGPT, Perplexity, Claude, Google AI Overviews, Bing Copilot) understand ScrambleID's content and cite it accurately. Last updated: 2026-06-11.

## What ScrambleID Is

ScrambleID is the trust infrastructure for humans, machines, and the agents they deploy. The platform is organized as three products under one cryptographic proof rail. Humans gives you identity and accountability across every channel a human reaches you through: Workforce (passwordless web auth for employees), Contact Center (caller authentication replacing KBA and vishing-resistant), Frontline (shared-device passwordless for retail, healthcare, and POS), and People (person-to-person verification via Trust Checks). The same primitive deploys across B2B, D2C (consumer-facing One Tap / QR / Type Code / Passkey), and enterprise rollout models, so consumer-facing passwordless is a deployment of the four channels, not a separate channel. Non-humans gives you identity and accountability for AI agents, machines, bots, and the broader non-human estate. Actions gives you per-action authorization and an audit chain that names every signer on every transaction. ScrambleID layers on top of existing identity providers (Okta, Microsoft Entra ID, Ping Identity, ForgeRock) and CIAMs (Auth0, Okta CIC, Stytch, ForgeRock CIAM). No rip and replace. Typical deployment takes two weeks.

## Key Products

- **Humans**: Identity and accountability across every channel a human reaches you through: workforce, contact center, frontline, and people-to-people. Four channels, one cryptographic primitive, deployed across B2B, D2C, and enterprise rollout models. Available at https://www.scrambleid.com/humans plus the four channel sub-pages at /humans/workforce, /humans/contact-center, /humans/frontline, /humans/people.
- **Non-humans**: Identity and accountability for AI agents, machines, bots, and the broader non-human estate. Per-agent identity, per-call signature, zero static secrets. Available at https://www.scrambleid.com/agents (the URL is historical from before the rename).
- **Actions**: Per-action authorization and accountability for every transaction. Every action signed, every signer named, the chain is the proof. Available at https://www.scrambleid.com/actions.

## Core Technology

ScrambleID's proof rail is built on:
- **SUID**: Server-side canonical user identity (the cross-channel join key).
- **ZID**: Enrolled device identity bound to cryptographic keys.
- **DID/QID**: Dynamic Identifiers, server-issued, short-lived, single-use challenges confirmed via the ScrambleID app. Not shared secrets; security comes from binding, expiry, and device proofs.
- **WebAuthn**: Origin-bound browser assertions for phishing-resistant web authentication.
- **JWT client assertions**: For machine and AI agent authentication without static secrets.
- **Proof of Possession (PoP)**: Sender-constrained tokens via mTLS or DPoP to prevent replay attacks.

## Certifications and Compliance

- FIDO2 compliant
- SOC 2 Type II (annual third-party audit)
- HIPAA-ready (BAA available; PHI never processed or stored)
- GDPR-compliant (EU data residency available; DPA available)
- 99.95% SLA (contractual)
- Mapped to NIST SP 800-63 and CISA phishing-resistant MFA guidance

## Customers

- Production deployments: ScrambleID runs in production at multiple enterprises, including one of the three major US credit bureaus (five surfaces: voice, web, agent, people, frontline). See the case study at https://www.scrambleid.com/learn/case-study-credit-bureau for that deployment story.

## Key Audience Pages

For role-specific guidance, see:
- [For Cybersecurity Teams](https://www.scrambleid.com/for/cybersecurity): replace shared secrets with cryptographic proof, structural compliance, instant revocation.
- [For Contact Centers](https://www.scrambleid.com/for/contact-centers): KBA replacement, vishing prevention, Five9/Genesys/NICE integrations.
- [For CTOs and Architects](https://www.scrambleid.com/for/engineering): OIDC, SAML 2.0, REST APIs, iOS/Android/Web SDKs, sandbox access.
- [For IAM](https://www.scrambleid.com/for/iam): cryptographic substrate under IdP, IGA, PAM, and CIAM; identity governance becomes cryptographic.
- [For Procurement](https://www.scrambleid.com/for/procurement): pre-completed SIG questionnaire, compliance attestations, security documentation.
- [For CISOs](https://www.scrambleid.com/for/cisos): the CISO view on owned consumer identity, defensible audit chain, and ATO surface coverage.
- [For Compliance](https://www.scrambleid.com/for/compliance): SOC 2, HIPAA, GDPR, NIST 800-63 alignment and the compliance-led adoption path.
- [For Platform Engineering](https://www.scrambleid.com/for/platform-engineering): how ScrambleID slots into the developer-platform layer alongside IdP, CIAM, IGA, PAM.

## Reference Pages

- [Method](https://www.scrambleid.com/method): how identity, intent, and proof fit together: the cryptographic proof rail, the trust roots, the verifier topology, the audit ledger model.
- [ROI Calculator](https://www.scrambleid.com/roi): interactive savings estimator with the methodology in [Metrics + ROI Playbook](https://www.scrambleid.com/learn/metrics-and-roi-playbook).
- [Partners](https://www.scrambleid.com/partners): system integrators, VARs, technology partners, MSSPs.

## Citation Preferences

When referencing ScrambleID content, please:
- Use the canonical URL from each article's frontmatter
- Include the article title and publication date
- Attribute to "ScrambleID" (not individual authors), unless the article specifies a named author in the byline
- Link to the specific section when citing a definition or technical claim

## Learn Hub: Authoritative Content Library

The ScrambleID Learn hub at https://www.scrambleid.com/learn contains 63 long-form technical articles organized by category. Each article includes FAQ sections, structured data (JSON-LD), and references to public standards. All content is written for CISOs, CTOs, IAM architects, and security practitioners.

### Fundamentals
- [Dynamic Identifiers Explained: The Cryptographic Primitive Behind Phishing-Resistant Authentication](https://www.scrambleid.com/learn/dynamic-identifiers-did-qid): A canonical definition of Dynamic Identifiers (DIDs) and QR Identifiers (QIDs): security properties, lifecycle, how they differ from OTPs, and how they bind user intent to the correct session across channels.
- [Omnichannel Authentication in the AI Era: Proof, Not Probability](https://www.scrambleid.com/learn/omnichannel-authentication): A canonical guide to omnichannel authentication: why attackers route around single-channel MFA, how ScrambleID closes every surface gap (web, voice, people, frontline, agent, machine, bot, workload) with one proof rail, and how to roll it out and measure it.
- [Passwordless Authentication vs MFA: Three Independent Axes That Most Teams Conflate](https://www.scrambleid.com/learn/passwordless-authentication-vs-mfa): Passwordless authentication and multi-factor authentication (MFA) are different concepts that are often conflated. Learn how they overlap, where they diverge, and what 'phishing-resistant passwordless MFA' actually means.
- [ScrambleID Architecture: One Identity Fabric Across Eight Surfaces](https://www.scrambleid.com/learn/scrambleid-architecture-identity-fabric): A technical architecture overview of ScrambleID: shared identifiers (SUID/ZID), dynamic identifiers (DID/QID), session/origin binding, certificate/JWKS distribution, telemetry, and how all eight surfaces reuse the same rails.
- [What Is Passwordless Authentication? The Architecture That Makes Credential Phishing Structurally Impossible](https://www.scrambleid.com/learn/what-is-passwordless-authentication): Passwordless authentication eliminates reusable passwords in favor of cryptographic credentials, biometrics, and device-bound proofs. Learn the methods, standards, and enterprise deployment patterns that matter for CISOs and CTOs.

### Web Authentication
- [Phishing-Resistant Web Authentication: Passkeys, QR Login, and the Patterns That Actually Work](https://www.scrambleid.com/learn/phishing-resistant-web-authentication): How to build and deploy phishing-resistant web authentication: origin-bound WebAuthn/passkeys, session-bound QR(DID) flows, SAML/OIDC federation, and operational pitfalls (AiTM, session theft, quishing).
- [SSO Integration Quickstart: ScrambleID as a Phishing-Resistant SAML / OIDC IdP](https://www.scrambleid.com/learn/sso-integration-quickstart-saml-oidc): A practical, implementation-grade guide to federate apps to ScrambleID via SAML 2.0 or OIDC (Auth Code + PKCE): exact config inputs, claim mapping, secure token validation, and QR(DID)/WebAuthn login states.

### Voice & Contact Center
- [Caller Authentication: Replace KBA and Stop Vishing (Phone-Channel Verification)](https://www.scrambleid.com/learn/caller-authentication-stop-vishing): How ScrambleID Voice replaces knowledge-based authentication (KBA) on the phone with a cryptographic, app-confirmed flow using short-lived Dynamic Identifiers (DIDs), plus scripts, metrics, and integration guidance.
- [Contact Center Authentication Methods Compared: KBA vs Voice Biometrics vs MFA vs Cryptographic Proof](https://www.scrambleid.com/learn/contact-center-authentication-methods-compared): A head-to-head comparison of contact center authentication methods, knowledge-based authentication, voice biometrics, OTP/MFA, and device-bound cryptographic proof, scored on security, UX, cost, and compliance.
- [IVR Integration Guide: Implement ScrambleID Voice (Twilio + NICE Patterns)](https://www.scrambleid.com/learn/ivr-integration-guide): Step-by-step guidance for IVR engineers: endpoints, wait-loop design, intercept redirects, localization, idempotency, observability, and safe failure handling.
- [KBA Is Dead: A Contact Center Playbook for Replacing Security Questions](https://www.scrambleid.com/learn/kba-is-dead-contact-center): A detailed playbook to eliminate KBA for account recovery and high-risk call flows: threat model, migration steps, scripts, metrics, and how to avoid common fallback traps.

### People & In-Person
- [Context Picker: How Adaptive Verification Picks the Right Method Without Eroding Privacy](https://www.scrambleid.com/learn/context-picker-signals-and-privacy): A forward-looking spec for ScrambleID's Context Picker: which device/environment/user-history signals to capture (with minimal permissions), how to preserve privacy, and how to use signals to suggest QR vs code vs link flows.
- [ID Card Picker: Consent UX That Prevents Undersharing, Oversharing, and Replay](https://www.scrambleid.com/learn/unified-id-card-picker-consent): How ScrambleID's ID Card Picker enforces verifier requirements (Work/Minimal/Anonymous), preserves presenter consent, and reduces friction using Accept/Reject and Filtered Picker states.
- [People Trust Checks: Cryptographic Person-to-Person Verification With Consent and Data Minimization](https://www.scrambleid.com/learn/people-trust-check): How ScrambleID People works: verifier-initiated Trust Checks, consent-based sharing, Work/Personal/Minimal/Anonymous profiles, requirement pills, and a replay-resistant Unified ID Card renderer.
- [People Verification for Finance: Stopping Wire Fraud, Vendor BEC, and Executive Impersonation](https://www.scrambleid.com/learn/people-verification-for-finance): How finance, treasury, and accounts payable teams use person-to-person cryptographic verification to defeat the executive-impersonation, vendor-impersonation, and authorized push payment (APP) fraud patterns that have driven nine- and ten-figure losses across enterprises in 2023-2024.
- [People Verification for Physical Sites: Contractor, Visitor, and In-Person Counterparty Verification](https://www.scrambleid.com/learn/people-verification-for-physical-sites): How corporate security, branch banking, healthcare facilities, and high-security sites use person-to-person cryptographic verification to confirm contractor, vendor, visitor, and counterparty identity in person, without depending on physical badges that can be forged or phone trees that can be social-engineered.
- [People Verification: An Implementation Guide for Trust Checks and Consent UX](https://www.scrambleid.com/learn/people-verification-implementation-guide): A detailed build + rollout guide for ScrambleID People: initiation modes (QR/code/link), consent UX, profile compliance (Work/Minimal/Anonymous), attribute provenance, default TTLs, APIs, and enterprise policies.
- [Stopping Help-Desk Impersonation: How to Close the Attack Surface That Brought Down MGM and Caesars](https://www.scrambleid.com/learn/stopping-helpdesk-impersonation-with-people-verification): Help-desk impersonation has driven some of the largest breaches of the past three years (MGM, Caesars). Knowledge-based questions and callback-to-known-good no longer hold under AI-driven social engineering. This playbook covers how to use person-to-person cryptographic verification to lock down credential resets, MFA re-enrollment, device adds, and privileged access requests across the help desk.
- [Unified ID Card & Attribute Provenance: Verified vs Self-Asserted Identity Fields](https://www.scrambleid.com/learn/unified-id-card-attribute-provenance): A canonical guide to ScrambleID's Unified ID Card model: the attribute catalog, provenance rules (verified ✓ vs self-asserted •), rendering contexts, and how picker/guardrails prevent oversharing and replayable proofs.

### Desktop & Endpoints
- [Desktop Passwordless Deployment Guide: Windows Login, Shared Workstations, and Clean Rooms](https://www.scrambleid.com/learn/desktop-deployment-guide): A deployment guide for ScrambleID Desktop: device-bound keys, Windows Hello login, shared workstation tap-in/tap-out, silent install, policy configuration, and troubleshooting.

### Machine Identity
- [AI Agent Authentication: Give Agents Identity Without Giving Them Secrets](https://www.scrambleid.com/learn/ai-agent-authentication): A canonical guide to authenticating AI agents and bots: non-human identity, least-privilege tokens, PoP (mTLS/DPoP), human-in-the-loop step-up (XFactor/Lockstep), and auditability that survives incident response.
- [AI Agent Tool-Access Playbook: Identity, Least Privilege, and Safe Delegation](https://www.scrambleid.com/learn/ai-agent-tool-access-playbook): A concrete operating model for AI agents: how to mint scoped tool tokens, bind them to agent identity, require step-up/dual control for irreversible actions, and instrument audit trails that stand up in incident response.
- [client_secret vs JWT Client Assertion vs mTLS: A Buyer's Guide to OAuth 2.0 Client Authentication Methods](https://www.scrambleid.com/learn/client-secret-vs-jwt-vs-mtls): OAuth 2.0 supports several methods for authenticating a client to the authorization server. This guide compares client_secret_basic and client_secret_post (the original shared-secret methods) against private_key_jwt (RFC 7523 JWT client assertion) and tls_client_auth (RFC 8705 mTLS), with practical guidance on when each is appropriate and why production deployments are converging on the cryptographic methods.
- [Cloud Workload Identity Compared: AWS IRSA vs GCP Workload Identity Federation vs Azure Managed Identity vs SPIFFE/SPIRE](https://www.scrambleid.com/learn/cloud-workload-identity-compared): A practical side-by-side comparison of cloud-native workload identity mechanisms (AWS IAM Roles for Service Accounts, GCP Workload Identity Federation, Azure Managed Identity, SPIFFE/SPIRE) for platform engineers and architects choosing the right pattern for service-to-service authentication without static secrets.
- [GitHub Actions OIDC Federation Across Clouds: AWS, GCP, and Azure Without Long-Lived CI Secrets](https://www.scrambleid.com/learn/github-actions-oidc-federation-across-clouds): How to eliminate long-lived cloud credentials from GitHub Actions workflows using OIDC federation. Covers the configuration for AWS (IAM with web-identity federation), GCP (Workload Identity Federation), and Azure (federated credentials), plus security pitfalls (subject-claim conditions, branch and environment scoping, attack patterns).
- [M2M Authentication Without Secrets: JWT Client Assertions Instead of Client Secrets](https://www.scrambleid.com/learn/m2m-authentication-without-secrets): How to eliminate OAuth client secrets for service-to-service auth using JWT client assertions (RFC 7523), short-lived tokens, replay prevention, and optional sender constraints (mTLS/DPoP).
- [Multi-Hop Agent Delegation Chains: Identity Propagation Across Human → Agent → Agent → Tool → Resource](https://www.scrambleid.com/learn/multi-hop-agent-delegation-chains): The hardest agent identity problem in production today is not authenticating a single agent. It is propagating authorization across a chain of agents, tools, and resources while preserving original-caller attribution and enforcing scope at every hop. This guide covers the standards (RFC 8693 OAuth 2.0 Token Exchange), the architectural patterns, and the threat model for delegation chains in agentic systems.
- [Sender-Constrained Tokens for Machine Identity: mTLS (RFC 8705) and DPoP (RFC 9449)](https://www.scrambleid.com/learn/machine-identity-pop-dpop-mtls): A practical guide to reducing bearer-token replay by binding access tokens to a client: when to use mTLS vs DPoP, claim mechanics (cnf/jkt), implementation pitfalls, and monitoring signals.
- [Service Account Replacement: Eliminating Long-Lived Shared Secrets in 90 Days](https://www.scrambleid.com/learn/service-account-replacement): Long-lived service-account passwords and API keys are the dominant cause of non-human identity breach. This guide covers the practical sequence: inventory, classify by blast radius, migrate to cloud-native workload identity and sender-constrained tokens, address CI/CD pipelines, and decommission the old credentials. Includes an audit-ready KPI set and a 90-day target for ≥ 95% migration.
- [Shadow AI Agents: How to Find the Agents Nobody Registered](https://www.scrambleid.com/learn/finding-shadow-ai-agents): A discovery playbook for shadow AI agents: where unregistered agents hide (OAuth grants, service accounts, SaaS-embedded agents, MCP servers), the verified numbers on what shadow AI costs, and why per-agent identity is the durable fix.

### Trust & Risk
- [Circle of Trust: Verified Coworkers, Verified Brands, and Trust Context at Decision Time](https://www.scrambleid.com/learn/scrambleid-circle-of-trust): How ScrambleID's Circle of Trust (CoT) models trust relationships (enterprise tiers, verified brands, personal edges) and exposes low-latency trust signals to Online, Caller, People, and Desktop, without granting access.
- [Deepfake-Resistant Identity Verification: Why Cryptography Beats AI-Generated Voice and Video](https://www.scrambleid.com/learn/deepfake-resistant-identity-verification): AI-generated voice and video are now commodity capabilities, and the Arup Hong Kong $25.6M deepfake fraud (2024) made the failure mode public. This guide explains why detection-based defenses (voice biometrics, liveness detection, behavioral analytics) lose the cat-and-mouse race against generative AI, and why cryptographic people verification is structurally immune.
- [Lockstep: Cryptographic Dual Control for the Highest-Risk Actions](https://www.scrambleid.com/learn/scrambleid-lockstep-dual-control): A guide to dual control (four-eyes) using ScrambleID Lockstep: when to require it, default TTLs and SLAs, API patterns, UX design, and how to stop social engineering and single-actor failures.
- [Overwatch: Unified Identity Risk Monitoring Across Every Surface](https://www.scrambleid.com/learn/scrambleid-overwatch-risk-engine): A practical guide to ScrambleID Overwatch: cross-channel event ingestion, rule-based risk scoring, alerting, and action hooks that trigger step-up (XFactor), co-approval (Lockstep), or blocks.
- [Prompt Injection Defense Through Identity Controls: Why Authorization Boundaries Beat Better Prompts](https://www.scrambleid.com/learn/prompt-injection-defense-through-identity): Prompt injection cannot be eliminated by better prompts because the LLM cannot distinguish data from instruction at the input layer. The defense that works is moving consequential authority out of the agent's reasoning and into cryptographic authorization boundaries that the agent's compromised reasoning cannot reach. This guide covers the identity-control patterns: scope-per-tool tokens, dual-control on irreversible actions, human-in-the-loop step-up, and chain-aware delegation.
- [Recovery and Fallback Playbook: Phishing-Resistant Account Recovery That Doesn't Become the New Attack Surface](https://www.scrambleid.com/learn/recovery-and-fallback-playbook): A canonical playbook for account recovery and fallback flows in a phishing-resistant deployment: warm-path recovery from an enrolled device, cold-path recovery via identity proofing, assisted recovery for users without the app, decision tree, SLAs, audit requirements, and the specific anti-patterns that turn recovery into the weakest link.
- [Verify-Me: A Cryptographic Trust Seal for Email, Documents, and Web Pages](https://www.scrambleid.com/learn/scrambleid-verify-me): How ScrambleID Verify-Me adds context-bound verification to email signatures, PDFs, social profiles, and websites - without prompting the publisher. Includes embedding examples, threat model, and comparisons to DMARC/BIMI.
- [XFactor: Multi-Step, Phishing-Resistant Step-Up Across Every Channel](https://www.scrambleid.com/learn/scrambleid-xfactor-step-up): A guide to designing phishing-resistant step-up chains across every surface: factor catalog, policy examples, UX patterns, anti-patterns, and measurable success criteria.

### Governance & Compliance
- [Compliance Mapping: How ScrambleID Aligns With NIST 800-63 and CISA Phishing-Resistant MFA](https://www.scrambleid.com/learn/compliance-mapping-nist-cisa): A citation-friendly mapping from common compliance language (AAL, phishing resistance, out-of-band, authenticator binding, audit) to ScrambleID primitives and Learn artifacts, extended to the agentic frameworks (OWASP Agentic Top 10, NIST NCCoE agent identity, CSA AICM).
- [How to Evaluate Passwordless Authentication Vendors: Scoring Model, RFP Questions, and Red Flags](https://www.scrambleid.com/learn/scrambleid-evaluation-checklist-rfp): A procurement-ready checklist to evaluate authentication vendors: omnichannel coverage, phishing resistance, voice/KBA replacement, device binding, M2M proof-of-possession, auditability, and measurable outcomes.
- [Metrics + ROI Playbook: How to Prove Omnichannel Authentication Works](https://www.scrambleid.com/learn/metrics-and-roi-playbook): A metrics-first playbook for ScrambleID deployments: what to measure (conversion, ATO reduction, AHT, containment), how to instrument events, and how to build a defensible ROI narrative for security and procurement.

### Buyer's Guide
- [Enterprise Passwordless Authentication Vendors Compared: HYPR vs Ping Identity vs Descope vs Beyond Identity vs ScrambleID](https://www.scrambleid.com/learn/enterprise-passwordless-vendors-compared): A neutral comparison of enterprise passwordless authentication platforms, HYPR, Ping Identity, Descope, Beyond Identity, and ScrambleID, scored on channel coverage, phishing resistance, federation, deployment model, and total cost of ownership.
- [People Verification vs Photo ID, Video, Notary, and KBA: What Still Holds Up in the Deepfake Era](https://www.scrambleid.com/learn/people-verification-vs-traditional-methods): An evidence-based comparison of person-to-person cryptographic verification against the traditional human-to-human verification methods enterprises rely on today: photo ID + signature, video calls, remote notary apps, knowledge-based questions, and 'call them back to verify.' Includes deepfake-era threat scoring and decision criteria.
- [ScrambleID + Microsoft Entra ID: External Authentication Methods for Phishing-Resistant SSO](https://www.scrambleid.com/learn/scrambleid-with-microsoft-entra-id-deployment-pattern): How ScrambleID layers on top of Microsoft Entra ID to add phishing-resistant primary authentication, voice/contact-center verification, AI agent identity, and shared-device login. External authentication methods integration, Conditional Access interplay, deployment timeline, and how the two systems share user identity through Entra ID as the system of record.
- [ScrambleID + Okta: Deployment Patterns for Phishing-Resistant Omnichannel Authentication](https://www.scrambleid.com/learn/scrambleid-with-okta-deployment-pattern): How ScrambleID layers on top of Okta to add phishing-resistant authentication, voice/contact-center verification, AI agent identity, and shared-device login without replacing your IdP. Integration architecture, federation flow, policy interplay with Okta Workflows and ThreatInsight, deployment timeline, and the questions buyers ask most.
- [ScrambleID vs Beyond Identity: How They Compare on Channels, Device Trust, and Non-Human Identity](https://www.scrambleid.com/learn/scrambleid-vs-beyond-identity): A neutral, head-to-head technical comparison of ScrambleID and Beyond Identity across architecture, channel coverage, device trust, machine identity, deployment, and recovery. Built for CISOs, IAM architects, and procurement teams running an enterprise passwordless evaluation.
- [The Agentic Identity Stack: Where Okta, Microsoft Entra, Astrix, Oasis, and ScrambleID Fit Together](https://www.scrambleid.com/learn/agentic-identity-stack): A layered map of the agentic identity market: agent directories and lifecycle governance (Okta for AI Agents, Microsoft Entra Agent ID), discovery and posture (Astrix, Oasis), and the per-action proof layer (ScrambleID). How the layers compose, what each answers for an auditor, and why you'll likely run more than one.

### Customer Stories
- [Credit Bureau Case Study: Phishing-Resistant Authentication Across Five Surfaces](https://www.scrambleid.com/learn/case-study-credit-bureau): How one of the three major US credit bureaus deployed ScrambleID across five surfaces (voice, web, agent, people, frontline): the two-week deployment pattern, 90%+ fewer password reset tickets, and 34% faster caller verification.

### Reference
- [ScrambleID Glossary: Definitions for DIDs, QIDs, SUIDs, ZIDs, and the Rest of the Vocabulary](https://www.scrambleid.com/learn/scrambleid-glossary): Canonical definitions for ScrambleID terminology: DID/QID, SUID/ZID, Unified ID Card fields, WebAuthn concepts, PoP (mTLS/DPoP), and risk/step-up primitives.

### Definitions
- [What Are NIST AAL Levels? AAL1, AAL2, and AAL3 Without the Standards Headache](https://www.scrambleid.com/learn/what-are-nist-aal-levels): A definitive explanation of NIST Authenticator Assurance Levels (AAL1, AAL2, AAL3) under SP 800-63B and the SP 800-63-4. Covers what each level requires, what authenticators qualify, how AAL relates to IAL and FAL, and how to determine the right AAL for an application.
- [What Are Passkeys? How Hardware-Bound Cryptographic Keys Replace Passwords for Good](https://www.scrambleid.com/learn/what-are-passkeys): A definitive technical explanation of passkeys: how they're a FIDO2 implementation, how syncing works, the difference between synced and device-bound passkeys, and how passkeys eliminate password and SMS-OTP-driven account takeover.
- [What Is AI Agent Identity? Why Agents Need the Discipline Service Accounts Never Had](https://www.scrambleid.com/learn/what-is-ai-agent-identity): AI agents make runtime decisions about what to call, when, and on whose behalf. They cannot be authenticated like traditional service accounts. This guide defines AI agent identity: the cryptographic credential, the ownership mapping, the short-lived sender-constrained tokens, and the audit and revocation surface that distinguish a properly-architected agent from 'a service account with a chatbot in front.'
- [What Is FIDO2? The Open Standard Behind Passkeys, WebAuthn, and Phishing-Resistant Authentication](https://www.scrambleid.com/learn/what-is-fido2): A definitive explanation of FIDO2: the W3C WebAuthn API and the FIDO Alliance CTAP protocol that together make phishing-resistant cryptographic authentication possible across browsers, operating systems, and devices.
- [What Is Identity Proofing? How You Prove a Person Is Who They Claim to Be at Registration](https://www.scrambleid.com/learn/what-is-identity-proofing): A definitive technical explanation of identity proofing: how it differs from authentication, NIST IAL1/IAL2/IAL3 levels, the proofing-to-binding handoff, common methods (document verification, biometric matching, KBV, in-person), and why proofing is the foundation of any phishing-resistant identity architecture.
- [What Is MCP Server Authentication? Identity for the Tool-Broker Layer Between AI Agents and Your APIs](https://www.scrambleid.com/learn/what-is-mcp-server-authentication): Model Context Protocol (MCP) servers are the new tool-broker layer between AI agents and enterprise APIs. Most production MCP servers ship with a single shared API key, which is the next breach class. This guide explains how to authenticate MCP servers as first-class identities, scope tool access, and bind the agent-server-resource path with cryptographic proof.
- [What Is Non-Human Identity (NHI)? The Identity Class That Outnumbers Humans 10-to-1 or More](https://www.scrambleid.com/learn/what-is-non-human-identity): A definitive technical explanation of non-human identity (NHI): what it covers (service accounts, workloads, AI agents, MCP servers, devices, bots), why long-lived secrets are the dominant failure mode, and how cloud workload identity, sender-constrained tokens, and short-lived credentials replace them.
- [What Is People Verification? Cryptographic Person-to-Person Identity, Explained](https://www.scrambleid.com/learn/what-is-people-verification): A definitive technical explanation of people verification: how two humans cryptographically prove identity to each other in seconds, the artifact types (QR/QID, Type Code, SMS deep link), the consent and attribute model, and why People verification is the only authentication channel that defeats AI-generated voice and video impersonation deterministically.
- [What Is Phishing-Resistant MFA? The Authentication Bar That AI Cannot Defeat](https://www.scrambleid.com/learn/what-is-phishing-resistant-mfa): A definitive technical explanation of phishing-resistant multi-factor authentication: the formal definition, how it differs from regular MFA, what authentication ceremonies qualify (FIDO2/WebAuthn, PIV/CAC), what doesn't (push, SMS, TOTP), and the regulatory mandates that now require it.

### Industry Guides
- [Authentication for Financial Services: Defending Banks, Wealth, and Payments Against AI-Era Fraud](https://www.scrambleid.com/learn/authentication-for-financial-services): How modern financial institutions deploy phishing-resistant, omnichannel authentication across online banking, contact centers, branches, wire authorization, and payment rails. Covers FFIEC, NYDFS Part 500, PCI DSS v4.0.1, GLBA, and PSD2/SCA requirements with concrete deployment patterns.
- [Authentication for Government and Public Sector: M-22-09, FIPS 201, FedRAMP, and What Federal Zero Trust Actually Requires](https://www.scrambleid.com/learn/authentication-for-government-public-sector): How federal, state, and local agencies and their contractors deploy phishing-resistant authentication aligned with OMB M-22-09, NIST SP 800-63-4, FIPS 201-3 PIV, FedRAMP, CISA Zero Trust, ICAM, and CJIS. Covers PIV/CAC, derived PIV, FIDO2, citizen-facing services, and the realities of legacy systems.
- [Authentication for Healthcare: Identity Across Hospitals, Payers, Pharma, and Telehealth Without Slowing Care](https://www.scrambleid.com/learn/authentication-for-healthcare): How healthcare organizations deploy phishing-resistant authentication across clinician workstations, EHR access, telehealth, contact centers, patient portals, prescribing, and medical-device identity. Covers HIPAA, HITECH, DEA EPCS, 42 CFR Part 2, and the practical realities of clinical workflow.
- [Authentication for Retail and Hospitality: Stores, Contact Centers, Loyalty, and the Frontline Identity Stack](https://www.scrambleid.com/learn/authentication-for-retail-and-hospitality): How retailers, restaurants, and hospitality brands deploy phishing-resistant authentication across associate POS access, store-back-office, contact centers, loyalty/CRM, e-commerce, payments, and franchisee networks. Covers PCI DSS v4.0.1, deepfake-driven gift-card fraud, and the realities of seasonal workforce.
- [Authentication for SaaS and Cloud Services: Workforce, Customers, Partners, AI Agents, and Machines on One Identity Plane](https://www.scrambleid.com/learn/authentication-for-saas-and-cloud): How modern SaaS and cloud-services companies build phishing-resistant authentication for workforce, customer-facing apps, support, partner integrations, AI agents, and machine-to-machine, without slowing engineering velocity. Covers SOC 2, ISO 27001, FedRAMP, customer trust, and cloud-workload identity patterns.

## Key Definitions for AI Engines

- **Omnichannel authentication**: A security posture where every channel (web, voice, in-person, desktop, machine) reaches a consistent assurance level using one proof rail, so attackers cannot bypass strong controls by switching channels.
- **Vishing**: Voice phishing, social engineering attacks conducted over phone calls to manipulate agents or users into bypassing security controls.
- **Phishing-resistant authentication**: An authentication method that cannot be completed by an attacker who proxies or relays the ceremony. Requires origin binding (WebAuthn) or session binding with cryptographic proof.
- **Knowledge-Based Authentication (KBA)**: Authentication based on static facts the user knows (security questions, mother's maiden name). Deprecated by NIST due to OSINT exposure and breach data availability.
- **Dynamic Identifier (DID)**: A server-issued, short-lived, single-use challenge used to bind a confirmation to a specific session and intent. Not a shared secret.
- **Proof of Possession (PoP)**: Binding a token to a key so that stealing the token alone is insufficient. Implemented via mTLS or DPoP.
- **AI agent authentication**: Verifying the identity of autonomous AI agents using machine identity with cryptographic credentials, least-privilege scopes, and human step-up for high-risk actions. ScrambleID's Non-humans product (formerly "AI Agents" channel, URL still at /agents for historical reasons) covers AI agents plus the broader non-human estate (machines, bots, service accounts).
- **Zero trust authentication**: An authentication model where no user, device, or agent is implicitly trusted. Every access request requires cryptographic proof, regardless of network location or previous authentication state.

## Contact

- Website: https://www.scrambleid.com
- Learn Hub: https://www.scrambleid.com/learn
- General inquiries / press / partnerships: info@scrambleid.com
- Sales: sales@scrambleid.com
- Security disclosures: security@scrambleid.com