Summary
Opt-in local authentication gate: before Elevate performs a privileged action, the user verifies with Touch ID, Apple Watch or the account password. Once unlocked, the app stays unlocked until the Mac is locked, put to sleep or left idle for a configurable period; after the Mac is unlocked, Elevate asks again.
Motivation
Elevate holds refresh tokens that can activate privileged roles. On an unlocked Mac anyone within reach can activate a Global Administrator role in two clicks. A local unlock gate raises the bar for the "colleague walks past your unlocked laptop" case and for processes driving the UI. It does not protect the tokens themselves (keychain and MSAL cache are unchanged) and the setting's description must say so.
Proposed behaviour
- Gate actions, not viewing. Activate, extend, run profile, approve/deny and deactivate prompt; eligibility, active roles and countdowns stay visible. Matches the Passwords app and 1Password.
- Unlock lifetime. In memory only, never persisted. Cleared on
com.apple.screenIsLocked, NSWorkspace.sessionDidResignActive (fast user switching), sleep/wake, and after an idle window (default 15 minutes, configurable).
- Authentication.
LAContext with deviceOwnerAuthentication so Touch ID, Apple Watch and password fallback all work, including Macs without a sensor; reuse duration 0 so every unlock is a real prompt. Reason string names the action, e.g. "Activate Global Administrator in Reothor Lab".
- Edge cases. Global shortcut and quick activation become prompt-then-run. Scheduled activations run without a prompt because the user authorised them when scheduling.
- Default off. Users under Conditional Access already face MFA on activation; a second local prompt is only worth it where the local threat model matters.
Implementation sketch
LocalAuthGate in the app layer, an AppSettings flag, lock/idle observers in the model, and the gate wrapped around the activation entry points. Tests for the unlock lifetime logic (pure state machine in Core).
Summary
Opt-in local authentication gate: before Elevate performs a privileged action, the user verifies with Touch ID, Apple Watch or the account password. Once unlocked, the app stays unlocked until the Mac is locked, put to sleep or left idle for a configurable period; after the Mac is unlocked, Elevate asks again.
Motivation
Elevate holds refresh tokens that can activate privileged roles. On an unlocked Mac anyone within reach can activate a Global Administrator role in two clicks. A local unlock gate raises the bar for the "colleague walks past your unlocked laptop" case and for processes driving the UI. It does not protect the tokens themselves (keychain and MSAL cache are unchanged) and the setting's description must say so.
Proposed behaviour
com.apple.screenIsLocked,NSWorkspace.sessionDidResignActive(fast user switching), sleep/wake, and after an idle window (default 15 minutes, configurable).LAContextwithdeviceOwnerAuthenticationso Touch ID, Apple Watch and password fallback all work, including Macs without a sensor; reuse duration 0 so every unlock is a real prompt. Reason string names the action, e.g. "Activate Global Administrator in Reothor Lab".Implementation sketch
LocalAuthGatein the app layer, anAppSettingsflag, lock/idle observers in the model, and the gate wrapped around the activation entry points. Tests for the unlock lifetime logic (pure state machine in Core).