# MFA pilot: coulomb-social, optional, NetKingdom-held — 2026-10-09

Founder decision (Bernd, 2026-10-09). It answers the pilot and policy part of
NK-WP-0042-T02 (hub thread 892fd489). It does not resolve decision cef97ccd: user-perspective acceptance of the MFA journey still
needs the attended run (USER-WP-0027-T04, USER-WP-0028-T03).

## Decision

1. **Pilot workload:** coulomb-social.
2. **MFA code stays in NetKingdom infrastructure.** Enrollment, verification,
   replacement, recovery, and the policy that requires MFA live with the issuer
   (KeyCape / Keycloak, the provider factor) and user-engine (`/security`, the
   provider-management handoff, P04 recovery, P06 policy). coulomb-social does
   not gain factor, enrollment, recovery, or MFA policy code. It stays a plain
   OIDC relying party.
3. **MFA is optional for coulomb-social users.** Password-only sign-in stays
   valid (U05). Users may enroll voluntarily through the NetKingdom path (U06).
   Once a user has enrolled, the issuer enforces their factor (U07).
4. **Admin-required MFA is deferred, not urgent.** When a coulomb-social admin
   later wants MFA required for users, it will be an issuer-side client policy
   applied through the NetKingdom admin surface (P06 preview/apply/rollback). It
   will not be a coulomb-social code path. Turning it on is a separate change that
   needs the founder's go.

## Consequences

- No `acr_values=aal2` switch-on for coulomb-social now. Under optional MFA,
  coulomb-social requests no assurance level.
- coulomb-social already contains a dormant relying-party hook
  (`?assurance=aal2` → `acr_values`, plus a local acr check in
  `apps/identity/views.py`). Nothing links to it. Whether to keep it dormant or
  remove it is coulomb-social's call. The issuer-side policy route in (4) does
  not need it.
- coulomb-social may link users to the NetKingdom `/security` page for
  optional enrollment and recovery help. That link is navigation, not MFA logic.
- This narrows the SCOPE line "action step-up — consuming apps": for this
  pilot, step-up sits with KeyCape client policy.