---
title: "Preventing Destructive Actions with Step-up Authentication"
description: "The Agentic Arcade’s admin panel adds an admin-only “reset all scores” action to prevent a long-lived or stolen admin session from wiping every player’s history. It combines the arcade-admin role with step-up MFA, requiring a recognized MFA signal and auth_time or iat within five minutes. A shared helper checks amr, acr, or a tenant claim; buildMfaStepUpUrl uses acr_values and can add max_age=0, while mfa.challengeWithPopup() opens MFA before the reset request. A beforeSessionSaved hook preserves claims filtered by the Auth0 Next.js SDK, and the API enforces session, role, and freshness gates before clearing scores; cancelled or blocked popups stop the request."
---

# Preventing Destructive Actions with Step-up Authentication

[Auth0](https://yomu.fyi/company/auth0) · Jessica Temporal · Sep 17, 2026

**Type:** Tutorial

## Summary

The Agentic Arcade’s admin panel adds an admin-only “reset all scores” action to prevent a long-lived or stolen admin session from wiping every player’s history. It combines the arcade-admin role with step-up MFA, requiring a recognized MFA signal and auth\_time or iat within five minutes. A shared helper checks amr, acr, or a tenant claim; buildMfaStepUpUrl uses acr\_values and can add max\_age=0, while mfa.challengeWithPopup() opens MFA before the reset request. A beforeSessionSaved hook preserves claims filtered by the Auth0 Next.js SDK, and the API enforces session, role, and freshness gates before clearing scores; cancelled or blocked popups stop the request.

## Context

The feature addresses the gap between having an admin role or having completed MFA earlier and actively re-authenticating for a destructive action. The post applies the pattern to a reset that wipes every player’s scores and notes that it can extend to actions whose blast radius exceeds one user.

## Approach / What changed

The implementation adds a shared MFA step-up helper, an admin Danger Zone component, and a reset-scores API route. The client opens an MFA popup before sending the reset request, while the server checks for a session, the arcade-admin role, and a fresh MFA signal with a recent auth\_time or iat. A beforeSessionSaved hook retains amr, auth\_time, iat, acr, and the tenant’s custom claim so the freshness check can work.

## Takeaways

- A role proves that a user is an admin, but it does not prove that the person is currently present and intending to perform a destructive action.
- Freshness validation requires both an MFA step-up signal and a recent timestamp; checking only MFA enrollment, a timestamp, or either one alone is insufficient.
- The Auth0 Next.js SDK’s beforeSessionSaved hook must preserve the relevant claims, including iat, or the application can remain stuck at mfa\_required.

## FAQ

### Why does the reset require more than the arcade-admin role?

The role identifies an administrator but does not distinguish a current deliberate action from a stolen session, an unlocked laptop, or an old login. The reset therefore also requires a fresh MFA step-up.

### Why are both an MFA signal and a freshness timestamp checked?

The signal shows that MFA ran, while auth\_time or iat shows when the authentication occurred. Requiring both prevents a recent password-only login or an old MFA event from satisfying the gate.

### What can prevent the MFA popup flow from completing?

A browser may block the popup, or an omitted callback URL can leave the popup hanging at the redirect. If the administrator cancels the challenge, the SDK raises PopupCancelledError and the reset request is not sent.

**Tags:** [Auth0](https://yomu.fyi/topic/auth0), [Authentication](https://yomu.fyi/topic/authentication), [MFA](https://yomu.fyi/topic/mfa), [Security](https://yomu.fyi/topic/security)

- Source: [Auth0](https://auth0.com/blog/preventing-destructive-actions-with-step-up-authentication)
- Source URL: https://auth0.com/blog/preventing-destructive-actions-with-step-up-authentication
- Ingested by Yomu: 2026-09-17T18:00:09.902Z

[Read original post](https://auth0.com/blog/preventing-destructive-actions-with-step-up-authentication)