1. Create a scoped challenge
The host identifies the actor, protected operation, target resource, policy context, nonce and expiry. The challenge must be canonicalized so the signer and verifier interpret exactly the same operation.
2–3. Confirm presence and sign
The operator reviews the action and uses Qryption Key to confirm presence. The key signs the scoped challenge with the configured ML-DSA profile. User-interface integrity remains an external trust dependency.
4. Verify
The verifier checks signature validity, algorithm and version, challenge expiry, expected audience, operation binding and replay state. Any missing or ambiguous field produces a denial rather than a classical fallback.
5. Enforce and record
The existing authorization layer combines the verification result with organizational policy. It executes or denies the operation and records the challenge identifier, result, version information and relevant audit context without logging private key material.
Documentation status
This is conceptual documentation for the private pilot. It does not define wire formats, public SDK methods or deployment-specific security guarantees. Those details must be versioned with the pilot implementation.