Live and gated are different
Use /api/v1/readiness for capability state and /api/v1/rehearsal for the fail-closed launch decision. Independently gated protocols are not represented as active product behavior.
TRUST CENTER
Evidence for every identity decision.
Lucion Identity v6.6.6 publishes the active security contract, live capability evidence, operational boundaries, and explicit gaps. A capability is not called production-ready unless its runtime gate and release evidence agree.
Independent sign-in methods
Production authentication supports passkeys for phishing-resistant device sign-in and passwords for direct account sign-in. Email verification proves address control but never creates a session; replacement-passkey recovery and step-up remain explicit ceremonies.
Tenant-safe operations
Organization, SCIM, OAuth, API-key, webhook, and Lyra decisions bind user, organization, application, scope, resource, and actor context server-side.
Assurance is transparent
No SOC 2, ISO 27001, HIPAA, or independent penetration-test claim is made here. Backup/restore, rollback, incident-response, key-rotation, privacy-operations, and external-assurance evidence are documented as explicit manual actions until the Lucion Global process approves them.
Authentication and sessionsLive status unavailable
Transactional emailLive status unavailable
Organizations and SCIM lifecycleLive status unavailable
OAuth/OIDCLive status unavailable
Federation protocol executionLive status unavailable
Lyra external action executionLive status unavailable
Operational assuranceLive status unavailable
Hardware/device postureLive status unavailable
Capability matrix source: safe fallback. The matrix never grants access or replaces readiness.
Operational evidence
Release fingerprints, OpenAPI parity, migration state, dependency audit, security tests, and live readiness are automated evidence. Backup/restore, rollback, incident response, key rotation, privacy retention/deletion approval, and independent assurance remain explicit manual actions and are never implied by launch approval. The preserved /.well-known/replay-qa-security-nonce remains available for authorized Replay QA ownership checks; no replay run is claimed in this release.