pragma.vision Technology observatory & strategic foresight

Verification register Security & Identity

Readiness verdict

WebAuthn Level 3

A dated reading of what is claimed, reported, and independently verified in the current evidence.

As of
2026-10-01
Revision
3
Method
v1.4.0

Current reading

Readiness band and full integer triple

AI-assisted assembly · derived results

Readiness band

Watch

Primary summary from verified readiness

Confidence
85% · fresh
Computed at
2026-10-01T02:29:31.227875+00:00
Claimed
75

Public ambition and stated capability

Reported
55

Observed practitioner reporting

Verified
35

Independently supported evidence

Gap
+40

Claimed leads verified

Evidence strength Critical

Decision

What the current evidence supports

Agent-assisted assessment · independently reviewed · 2026-10-01

Adopt Level 3 features individually with configuration testing.

Why
The standard is final, while browser and credential-manager behavior remains uneven.
Next
Test each required feature's actual effects across supported providers and platforms, and retain server-side controls and fallback flows.

Constraints

Blockers

  • Implementation coverage differs by feature, browser and credential provider.
  • Capability flags can disagree with observed behavior.
  • Signal API calls may resolve without changing credentials.
  • PRF and storage extensions require testing on actual provider configurations.

Evidence summary

Derived counts

AI-assisted assembly

Total
9
Tier 1
6
Tier 2
2
Tier 3
1
Supports
4
Contradicts
2
Context
3
Latest observed
2026-09-30

Counts and dates only. Raw signals, private excerpts, trust records, and internal corpus material are not published here.

Publication record

Revisions

Revision 3

  1. 2026-07-19 Reading moved from ready to ready.
  2. 2026-09-22 Reading moved from ready to ready.
  3. 2026-10-01 Reading moved from ready to watch.

Your opinion

Tell us anything.

What works, what doesn't, what's missing — especially about our watches, lenses, and the register itself. Anonymous is fine; leave an email if you'd like a reply.