Authentication did not prove which human was present

Wrong claim

Why it feels true

An Identity Provider log showing a successful MFA challenge for dax.mercer@chronos.orbital feels like eyewitness proof that Dax personally initiated the session.

Precise correction

NIST SP 800-63-4 (final 31 July 2025) defines authentication as verifying control of an authenticator bound to a digital identity, which remains distinct from physical human attribution and from downstream authorization decisions.

A shared credential, an unattended unlocked workstation, or an MFA push prompt approved under fatigue can all produce a genuine authentication success log without the named person intending the action.

Principal Security Architect Vera Vance and Propulsion Lead Priya Nair can state as an observed fact that the account authenticated, while treating human presence and export authorization as separate questions requiring corroborating evidence.

NIST SP 800-63-4 Digital Identity Guidelines, final 2025-07-31 ↗

Go deeper

• F4: Identity, authentication, authorization, and recovery
• S1: Identity alert triage: reconstructing who, what, and how across logs
• SP 800-63-4 explainer: proofing, authenticators, and federation
• Authentication
• Authorization
• Account recovery