Countersign has a person confirm one sensitive action in an app, such as a change of salary account, a role grant or a deletion, at the moment it happens. They see exactly what they are agreeing to, and the app receives a signed record bound to that one action. It protects your apps from someone, or something, using a person’s signed-in session to act in their name.
The app’s developers decide which of its actions ask; you decide how people answer. The developer’s side is in Countersign.
Turn it on
-
In the hub, open Apps and choose the app. Countersign is for applications your organization runs itself, so the Countersign tab appears only for those: an app made from a catalog template can’t use it, because its vendor holds its credentials too.
-
Open Countersign and choose how people confirm:
Off The app can’t ask. Passkey A Trustaige window opens over the app, on the device the person is using, and they confirm with their passkey. Phone A notification on the person’s phone; they approve in Trustaige Identity. Shown once it is available to your organization. Changing the setting needs a recent sign-in, and is recorded in the audit log with the old and new choice.
-
Press Try Countersign. You countersign an example action yourself, exactly as the app’s people will, and see afterwards what they would see and every check the app makes on the result, each ticked. Nothing changes in the app: a trial’s record is made out so that no app accepts it, and the audit log shows it as a test.
What people see
The app’s name and your organization’s, the action in the app’s own words, and every detail the app sends, with a short reference that is the same on every screen. People can confirm or decline; declining is as easy as confirming. An action with many details is shown in full, and is harder to read: if Try it says an action shows more than eight details, ask the app’s developers which ones change the decision.
When someone didn’t ask
On the phone, a person who gets a request they didn’t start can tap This wasn’t me. The request is declined, a warning appears in your audit log, and requests to that person pause for 15 minutes, so no one can keep sending them until someone taps Approve. A trial never pauses anyone.
In the audit log
| Event | When |
|---|---|
verification.approved | A person countersigned an action. |
verification.declined | A person declined, or picked the wrong code on their phone. |
verification.reported | A person said a request wasn’t theirs. |
verification.tested | An admin tried Countersign on themselves. |