Specifies trust boundaries, tokens or credentials, abuse controls, expiry, revocation, and threat mitigations for multi-factor authentication. It fixes adoption boundaries and observable failure evidence while keeping environment-specific limits configurable.