---
id: USER-WP-0026
type: workplan
title: "Account recovery and visible identity and access"
domain: communication
repo: user-engine
status: active
owner: codex
topic_slug: user-engine
created: "2026-09-12"
updated: "2026-09-12"
state_hub_workstream_id: "0aea0a52-13f9-515b-bda8-665f8a4f2d5e"
---

The operator reports a dead-end authentication error after using an account
outside the product tenant. Recent issuer telemetry indicates token exchange
failure; tenant rejection and provider failure must not be conflated.

## Implement and validate recovery

```task
id: USER-WP-0026-T01
status: done
priority: high
state_hub_task_id: "86324ec8-cf2f-5e9e-bb60-670c4d792828"
```

Route failed browser login to the public account recovery surface without codes,
state or unverified identity. Show verified portal identity, tenant memberships,
and recorded workload memberships; preserve operator/customer separation.
Provide CSRF-protected portal logout and confirmed shared provider sign-out with
fixed owner-configured return locations. No automatic reauthentication loops,
MFA downgrade, global JWT revocation claim or inferred workload entitlements.

## Publish and verify the recovery flow

```task
id: USER-WP-0026-T02
status: progress
priority: high
state_hub_task_id: "ad5b0a77-d8ec-5e07-9a9e-2fa231a6f792"
```

Publish immutable images, update canonical runtime pins, verify anonymous
recovery and sign-out confirmation live, and record actual account switching
only after browser evidence. Existing application sessions may outlive provider
logout. Related: USER-WP-0025-T03 and VERGABE-WP-0019-T06.

Source verification: 182 tests passed with three optional integration skips; layer conformance passed. Immutable publication and live checks are in progress.

## Discover workload access from authoritative application records

```task
id: USER-WP-0026-T03
status: todo
priority: high
state_hub_task_id: "95e9a6d4-7e57-5483-97c5-3f4a45bb6767"
```

The requested cross-application allow list is not represented by the current
User Engine membership store. Establish a provider-owned workload catalogue and
read current application access decisions for the signed-in identity. Link only
registered HTTPS workload entry points. Distinguish allow, deny and unavailable;
never turn a tenant membership, platform role, application registration or a
missing access record into an inferred grant. Current UI displays recorded
workload memberships only; no complete fleet entitlement inventory is claimed.

### Live recovery rollout — 2026-09-12

Recovery is deployed in KeyCape 4d8b8fe, User Engine e54b6ee and Vergabe c067993
(Helm revision 3). All three are Ready. Six provider checks, eleven product
checks and six fresh anonymous Chromium checks pass, including actual provider
logout POST and return to the portal without test overrides. Real-user identity
switching is still awaiting operator evidence; no authenticated/MFA acceptance
is inferred. Detailed receipt: railiance-apps/docs/evidence/2026-09-12-account-recovery-live.md.