Welcome to Agentic Password & Access thatchecks identity against the record before anything resets.
Every reset is a security decision, and the biggest slice of the queue. Risely checks identity against the record, issues to a verified channel, and logs the whole ladder. A person takes what fails.
Verification · one request at a time
checking
Self-service reset · the middle of the night
a student locked out the night before a quiz
Checked against
the record, and only the record
the channels somebody verified earlier
the role rules for this appointment
Identity
three factors match the record
Channel
the recovery address already on file
Policy
the rule allows a student reset
Issue
reset sent · new multi-factor enrolment required
Access comes from the role, and the role has a limit.
Risely's agents read the appointment, grant what its rules already cover, and send anything beyond them to the person who owns that system. A grant nobody can justify by role is the one that outlives the job.
One role, one access set
adjunct · spring
The course shell for each section
granted by the teaching role
Library and campus mail
granted to every appointment
Grade entry for those sections
granted for the term, expires with it
The student information system
this role has never held it
The access nobody can justify by role is the access that survives a departure, so the rules grant it or the data owner does.
A reset lands where the record says, and never where the request came from.
The recovery address and the enrolled authenticator are on the record, and both were verified before today. Risely's agents use one of those, so an attacker who controls the inbox that asked gets nothing.
Where the reset goes
choosing
The recovery address on the record
allowedverified and unchanged this term
The enrolled authenticator
allowedverified on the registered device
The address the request came from
refusednobody has ever verified it
Sending a reset to the address that asked for it is how a helpdesk becomes the way in.
Changing the password is the smaller half of the job.
A stolen credential keeps working inside a session that is already open. Risely's agents end the sessions, revoke the tokens, retire the old recovery codes, and require a fresh multi-factor enrolment at the next sign-in.
After the password changes
sweeping
Every open session ends
Application tokens are revoked
The old recovery codes stop working
Multi-factor enrolment is required at the next sign-in
A stolen password keeps working through a live session, so Risely's agents close the session as well as the password.
The security review reads decisions instead of rebuilding them.
Each check, its result, and the channel it used land on an append-only log the moment they happen. The refusals write the same rows, which is what makes the log worth reading.
Every step lands on the record
append-only
The refusals write the same rows. An auditor can read what was turned down as easily as what was granted.
One thing moves. The verification re-runs.
A recovery number that changed last week, a role that ended in May, a device nobody registered. Any of them changes the answer, and every one runs the same way.
The phone on the record changed
updated in the portal last week
Risely holds the reset
a fresh channel is not a verified one
A different factor is asked for
one the change never touched
The trail records both
the change and the check that covered it
The rule decides the outcome
never the length of the queue
What changes, and how it runs.
The student takes the quiz
The reset arrived at the hour she needed it.
The helpdesk stops being the way in
Verification holds under volume and under sympathy.
The review reads a clean trail
Every check and every refusal carries its reason.
The technical read
Connects read-only to your directory, ticketing system, and SIS to start
A person takes every request the checks turn down
Every action lands on an append-only log
Runs alongside what you have. Nothing rips out.