Security model

Your CASA authenticators.

Passkeys are separate from ordinary password entry and may be requested again when a protected action needs fresh authorization.