Owner authentication policy

This private pilot is available only to invited Owners of claimed SentFrom.ai workspaces. Clerk identifies your existing account; it does not grant agent approval authority.

Approvals require a recently verified passkey with user presence and verification on this identity service. Owner sessions last at most five minutes. Your agent must not control the credential device, its PIN or biometric approval, or any synchronization and recovery account.

An operator activates your first passkey only after independently verifying you through a trusted human channel and comparing its full fingerprint. Additional passkeys require an already active passkey. Email and a Clerk session alone cannot enroll an active factor or recover Owner authority.

Lost-factor recovery requires independent operator verification and revokes all existing agent identities, passkeys and Owner sessions. Re-enrollment does not restore previous agent accounts. An operator can suspend pilot access immediately.

We store credential public keys, identifiers, device backup flags, short-lived challenges, hashed session identifiers and operator audit records. We do not receive your passkey private key, biometric data or device PIN. Passkey metadata does not certify your device's hardware security.