Zero standing privilege
Prefer short-lived, audience-bound tokens and just-in-time elevation over reusable credentials and permanent broad roles.
SECURITY & PRIVACY
Trust is an operating discipline, not a badge.
No Eye Beans is designed around separate trust domains, least privilege, short-lived authority, explicit evidence provenance, and clear failure modes.
Keys and workloads
Use managed key custody, rotation, workload attestation, and federation so services do not depend on copied long-lived secrets.
Data minimization
Separate proof results from source evidence, constrain retention, encrypt sensitive data, and avoid placing personal information in public or immutable registries.
Recovery is part of authentication
Account recovery, factor replacement, revocation, and support access need the same assurance and audit care as sign-in.
Explainable decisions
Record which policy and evidence produced a result without logging unnecessary personal data or secrets.
A practical sequence
Build the control plane before the credential marketplace.
Start with StoneToned accounts, organizations, passkeys, OIDC/OAuth, sessions, entitlements, authorization, audit, and operational controls. Add external proof providers, portable credentials, and asset provenance only behind stable interfaces and reviewed threat models.
Read the privacy policy