Multi-Factor Authentication Policy Enforcement

Security Officer configures org-level MFA policy: required for all users, or conditional (e.g., required outside corporate IP range, required for admin roles). User logs in with credentials;
authentication service checks MFA policy and challenges the user with TOTP, WebAuthn/passkey, or SMS OTP. On success, a short-lived MFA-verified claim is embedded in the JWT. High-privilege operations (approve payment run, export all data, change security settings) re-verify MFA inline even within an active session. Failed MFA attempts are rate-limited and trigger an alert after 5 failures.

mfa_enrollment { enrollment_id: string, user_id: string, method: enum(TOTP,WEBAUTHN,SMS_OTP), status: enum(ACTIVE,REVOKED), enrolled_at: timestamp, external_id: string };
mfa_recovery_code { code_hash: string, user_id: string, used: bool, used_at: timestamp };
mfa_audit { event_id: string, user_id: string, method: string, outcome: enum(SUCCESS,FAILURE), ip: string, timestamp: timestamp };
(reference, product may differ).

POST /v1/auth/mfa/enroll { method } -> 200 { secret_or_challenge, recovery_codes[] };
POST /v1/auth/mfa/verify { method, code } -> 200 { access_token };
POST /v1/auth/mfa/challenge { action_type } -> 200 { challenge_id };
GET /v1/users/{user_id}/mfa-status;
emits auth.mfa_verified and auth.mfa_failed events;
idempotent via external_id.

NOT_ENROLLED -> ENROLLED -> ACTIVE;
terminal REVOKED;
guard: 5 failed attempts triggers 15-min lockout;
recovery codes are single-use and hashed at rest;
re-challenge required for high-privilege actions even within active session.