It can apply to a person, device, service, or process. A successful result establishes an authentication context for a session or transaction; it does not decide what the authenticated subject may access.
Digital authentication should be designed as a lifecycle, not just a sign-in screen. Enrollment and authenticator binding establish the relationship, routine verification tests control of the authenticator, and recovery, replacement, revocation, and session management preserve that assurance over time. The required strength should reflect the harm that impersonation could cause.
Key points
Common evidencePasswords, cryptographic keys, security keys, one-time codes, smart cards, device-bound credentials, and biometrics used to activate an authenticator.
Protocol qualityResistance to guessing, replay, interception, verifier impersonation, phishing, and automated attack differs significantly between methods.
Operational controlsProtect enrollment, recovery, authenticator changes, fallback methods, verifier secrets, and authenticated sessions as carefully as routine sign-in.
Important limitationAuthentication does not prove that every stored attribute is correct, that the endpoint is safe, that the session remains under the subject’s control, or that any requested action is authorized.