Step-up authentication
Sign-in proves "you're at the keyboard right now". For most actions that's enough. For a handful of high-impact actions — transmit payroll, cosign equity, finalize account erasure, send the year-end tax filing — AxisSynapse asks for a fresh MFA proof at the moment of the action. This is step-up authentication: a single-use token that says "yes, I am still here, and I am authorizing this specific thing." The pattern protects you from session hijacking, accidental clicks, and insider mistakes alike.
TL;DR — The platform defines 27 confirmation purposes, and 22 are required by an action today. The prompt asks for a second factor — a passkey or security key for the most sensitive ones — and issues a single-use, IP-bound, short-lived token for that one action. Which factor each purpose needs is set by the platform, not per workspace; what your workspace controls is which factors are accepted at all, through the MFA policy.
What counts as a "high-impact action"
The platform keeps a closed list of purposes that require step-up. Every workspace gets the same list and the same factor rule for each one, so the audit trail means the same thing everywhere. A purpose is never invented by the action that asks for it: an action names one of these, or it cannot ask for a confirmation at all.
Every confirmation purpose
The table below is the complete list. The code in the last column is what the audit log records as the purpose. Four purposes are defined but not yet required by any action — they are listed so the set is complete, and they are marked.
| Field | What it does | Accepted values / default |
|---|---|---|
| Seal a payroll run | Locks a payroll run so nothing in it can be edited. | Any second factor · 120 seconds · Not yet required by any action · PAYROLL_SEAL |
| Transmit payroll (ACH) | Sends the NACHA file to the bank for direct-deposit payroll. Real money moves. | Passkey or security key only · 60 seconds · PAYROLL_TRANSMIT_ACH |
| Void a payslip | Reverses a payslip after it has been issued. | Any second factor · 120 seconds · PAYROLL_PAYSLIP_VOID |
| Cosign an equity grant | The second signature on an equity grant — a legal commitment. | Passkey or security key only · 90 seconds · EQUITY_GRANT_COSIGN |
| Adjust an equity grant | A mid-cycle change to an existing grant. | Any second factor · 120 seconds · Not yet required by any action · EQUITY_GRANT_ADJUSTMENT |
| Transmit year-end tax forms | Submits the W-2 / 1099 / T4 e-file. | Passkey or security key only · 60 seconds · YEAREND_TAX_TRANSMIT |
| Finalize an account erasure | Carries out a right-to-erasure request. It cannot be undone. | Passkey or security key only · 60 seconds · ERASURE_FINALIZE |
| Download one person's full data | Every record tied to one person, in one file. | Passkey or security key only · 120 seconds · Not yet required by any action · DATA_EXPORT_FULL |
| Export the whole workspace | Every record in the workspace — everyone's — in one download. | Passkey or security key if you have one enrolled, otherwise your authenticator app · 120 seconds · WORKSPACE_DATA_EXPORT |
| Turn off your MFA | Disables multi-factor sign-in on your own account. | Any second factor · 60 seconds · MFA_DISABLE |
| Remove your last factor | Removes the last verified second factor on your account. | Any second factor · 60 seconds · MFA_REMOVE_LAST_FACTOR |
| Tighten the workspace MFA policy | Narrows the factors the workspace accepts. It can lock people out. | Passkey or security key only · 120 seconds · TENANT_MFA_POLICY_TIGHTEN |
| Make someone a workspace administrator | The highest privilege a workspace can grant. | Passkey or security key only · 120 seconds · MEMBER_ROLE_ESCALATION |
| Change how the workspace signs in | Switches the workspace sign-in method, which re-authenticates everyone. | Any second factor · 120 seconds · SIGN_IN_METHOD_CHANGE |
| Configure single sign-on | Creating, editing, enabling or deleting a SAML provider. | Any second factor · 120 seconds · SSO_PROVIDER_CONFIG |
| Widen where workspace AI sends data | Turning AI on; saving the model a workspace's data is sent to (provider, endpoint, key, model); turning PII redaction off; lifting the residency pin that keeps data on the workspace's own model. The changes that only narrow it (AI off, redaction on, pinning) need no factor. | Any second factor · 120 seconds · AI_CONFIG_CHANGE |
| Create an admin-scoped access token | A personal access token that carries administrator authority. | Passkey or security key only · 120 seconds · Not yet required by any action · PAT_CREATE_ADMIN_SCOPE |
| Activate a signing template | Makes a document-signing template legally binding for new signers. | Any second factor · 180 seconds · DOC_SIGNING_TEMPLATE_ACTIVATE |
| Publish a workflow | Puts a workflow live in production. | Any second factor · 180 seconds · WORKFLOW_PUBLISH |
| Apply a reorganization | Commits a reorg simulation to the org chart for everyone. | Passkey or security key only · 120 seconds · REORG_APPLY |
| Delete a custom object | Permanently deletes a custom object's table and every record in it. | Any second factor · 120 seconds · CUSTOM_OBJECT_DELETE |
| Release a legal hold | Lifts a legal hold on a document in the library, so it can be deleted and purged again. Only a person can release one, with a reason, and the release is audited with who, when and why. | Any second factor · 120 seconds · LEGAL_HOLD_RELEASE |
| Permanently delete a document | Deletes a document from the library's recycle bin for good: its versions and every stored file they point at. It cannot be undone. Only a person can do it, and the audit log records it before any file is deleted. | Any second factor · 120 seconds · DOCUMENT_PURGE |
| Decide a high-impact approval | Approving a step your workspace policy put behind step-up; deciding a governance decision (a control implementation, a control mapping, an exception) either way; and, for some module approvals, rejecting one. | Passkey or security key only · 60 seconds · HIGH_IMPACT_APPROVAL |
| A module's high-impact action | An action a module declares high-impact — for example recording a won contract or exporting a list. The confirmation names the one action it is for and cannot be spent on another. | Any second factor · 120 seconds · Scoped to one action · MODULE_ACTION |
| Give someone access to an engagement | Giving a person a seat on an assessment or audit — an external assessor invited as a guest, or a member — or extending or changing one. It opens your compliance record to them. | Passkey or security key if you have one enrolled, otherwise your authenticator app · 120 seconds · GRC_EXTERNAL_ACCESS_GRANT |
| Publish your Trust Center | Publishing your Trust Center, or an item on it, to the internet; making a rule that can approve visitors automatically live; setting the NDA visitors accept; revoking every visitor's access at once; adding a board recipient who has no account. | Passkey or security key if you have one enrolled, otherwise your authenticator app · 120 seconds · GRC_TRUST_PUBLISH |
How the prompt feels
You click the high-impact button
Example: Transmit payroll in
/hcm/payroll. The button doesn't immediately commit; instead a step-up modal slides in.The modal names the purpose
The modal title says exactly what you're authorizing — Authorize payroll ACH transmit — and the body explains the consequence (in this case: real money moves).
You complete the MFA challenge
Tap your passkey, insert your hardware key, or type your TOTP code (whichever the per-purpose policy allows). If the purpose requires phishing-resistant, only passkey and hardware-key options appear.
The action proceeds
The platform redeems the single-use token, executes the action, and records both the step-up proof and the action itself in the audit log.
Why single-use + IP-bound
The token is bound to the IP that requested it and is consumed the moment it's used. That makes a stolen token useless: an attacker on a different network can't redeem it, and even on the same network they only get one shot per stolen session.
What an administrator controls
The factor rule for each purpose is the platform's and is the same in every workspace — there is no per-purpose setting to loosen or tighten. What a workspace administrator decides is which second factors the workspace accepts at all, in the MFA policy. The prompt offers only the factors that satisfy both the purpose's rule and the workspace policy, among the ones you have enrolled.
When nothing you have enrolled satisfies both — a purpose that needs a passkey and an account with only an authenticator app, say — the prompt says so and the action does not run. Enroll a passkey from your account's security page and try again.
Every field, explained
| Field | What it does | Accepted values / default |
|---|---|---|
| Purpose | One of the platform-defined high-impact actions listed above. | Read-only — the set is platform-managed so the audit trail means the same thing in every workspace. |
| Factor rule | Whether any second factor satisfies the prompt, or only a passkey or security key. | Set by the platform per purpose. The workspace MFA policy can narrow the factors offered; it cannot widen them. |
| Token lifetime | How long the confirmation stays valid before it must be redone. | Per purpose, 60 to 180 seconds (see the table above). Not configurable. |
| IP binding | The token is bound to the network address that requested it. | Always on. A token presented from a different address is refused. |
| Single use | A token is consumed the moment the action runs. | Always on. A second attempt is refused and recorded as ACCOUNT_STEPUP_REUSED — critical severity. |
| Action scope | For a module's high-impact action, the token names the one action it confirms. | Always on for that purpose. A confirmation for one action is refused for another. |
Audit codes
For SIEM ingestion + compliance review, this surface emits:
See Reference → Audit codes for the
canonical description of each. ACCOUNT_STEPUP_REUSED is the
critical-severity row — a single-use token presented twice raises
a real-time alert.
Common gotchas
- "I just signed in — why am I being asked again?" Step-up is intentional. Sign-in proves you were here when the session started; step-up proves you're still here at the moment of a high-impact action.
- "The prompt opened but my passkey didn't appear." Either no passkey is enrolled on this account, or the workspace MFA policy does not accept passkeys. Enroll one, or ask an administrator about the workspace policy.
- "The prompt says I have no factor available." The purpose needs a passkey or security key and the account has only an authenticator app, or the workspace policy does not accept any factor you have enrolled. The action is blocked and recorded as ACCOUNT_STEPUP_BLOCKED.
- "A step-up failed and now my session is locked." Failed step-ups don't lock the session — only the action is aborted. Re-attempt the action and retry the prompt. If repeated failures persist, the workspace's sign-in lockout may eventually kick in.
- "My second-signer didn't get a step-up prompt." Each signer is evaluated independently. The cosigner gets their own step-up at the moment they click cosign — not when you do.
Troubleshooting
| Error code | What it means | Fix |
|---|---|---|
STEP_UP_REQUIRED | The action needs a confirmation and none was provided — or the one provided used a weaker factor than the purpose needs. | Click the action again; the prompt appears. Use a passkey or security key if the purpose needs one. |
STEP_UP_INVALID | The confirmation expired, was already used, came from a different network address, belongs to another account, or was for a different action. | Click the action again and confirm from the same network. If you did not just confirm it twice, tell your administrator — a reused confirmation can mean a stolen session. |
NO_FACTOR_AVAILABLE | Nothing you have enrolled satisfies the purpose and the workspace policy together. | Enroll a passkey from your account's security page, or ask an administrator about the MFA policy. |
UNKNOWN_PURPOSE | The request named a purpose that is not on the list above. | An integration error, not something a person can fix; report it. |
Related