Elevate experiment
Clearance desk
Sign in, pick a method the server offers, then try a privileged write.
L1 step-up only — password, TOTP, or passkey. No MEK, no PRF.
Clearance blotter
Who can write?
Rubber-stamp the session (L0), then a fresh step-up (L1). Vault unlock (L2) is out of scope on this desk.
Password step-up is allowed for the privileged write only when this account has no passkey or TOTP. Recovery still needs a stronger factor. The server decides — not this page.
Session stamp · L0
Shared lab account. Distinct-factor policy compares elevate category to this L0 stamp.
signed out — open the account modal
Advanced: inline password / passkey sign-in
Enroll factors
Server enrollment drives GET /elevate/methods. Enable TOTP uses the password field above when the account has one.
Step-up methods · L1
Server offers: sign in first
Privileged write
POST /api/app/secrets requires a valid elevate claim — not vault unlock.
—