🪜 Assurance Ladder
A fresh OTP alone isn't enough for a genuinely sensitive action — you also need proven identity. This ladder combines a fresh second-factor step-up (AAL) with identity verification (IAL) and gates a real demo action behind the top rung, so completing identity verification actually unlocks something.
Learn → Step-up & assuranceLearn → Identity verification — proving there’s a real personLearn → Adaptive risk-based MFA
Your position
The gate
An inert demo "high-value operation" — no real side effect, just proof the gate was cleared. It runs only at level 2.
X-ray
🩻 X-ray — what actually happened
Your own insert-only audit trail — the real server events, sanitized (never a secret), each linked to the lesson that explains it.