# P06 authentication policy acceptance

Scoped to `vergabe-demo-company` and `user-engine-portal`. The issuer owns
persistent policy, revision-bound previews, acknowledged apply, durable receipts
and reviewed rollback. Explicit application AAL2 remains authoritative. Portal
administration requires MFA; policy and factor recovery require recent MFA.

Optional means password-only until a confirmed active authenticator exists.
Provider lookup failures deny login. Pending setup can be cancelled; active
factor replacement requires audited recovery, including from old AAL1 sessions.

## Verification

- Previous interrupted run: full Go suite and 232 database-backed portal tests passed.
- Resumed run: all 30 portal Chromium checks and five portal policy tests passed.
- Issuer policy/runtime regression tests passed; two policy rollout and one
  provider guard deployment tests passed.
- Installed privacyIDEA fixture `provider-p06-browser-46713f7e`: native adapter
  confirms no-factor/pending login, activation, old-session MFA, explicit AAL2
  and successful OTP sign-in. Five browser checks pass: correct identity,
  pending possession proof, cancellation, confirmed activation and denied
  replacement with a visible recovery route.
- Provider image: `ghcr.io/gpappsoft/privacyidea-docker@sha256:af7841adad262f129e0c1d4f553af13f21cb2f4dc713533f316cfe43ed0b4473`.

Fixture repairs submit OTP to `/authorize/callback`, wait for asynchronous TOTP
selection, and wait for loaded pending state and an enabled Delete button.
The fixture uses disposable databases and synthetic identities, with no
production account changes. Reproduce using key-cape
`scripts/provider_browser_acceptance.py` and user-engine
`scripts/browser_journeys.py`.

## Release

Pending CI image publication and ordered live rollout. Do not infer deployment
or complete platform journey acceptance from these test results.