---
id: USER-WP-0033
type: workplan
title: "P06 scoped authentication policy and safe optional onboarding"
domain: communication
repo: user-engine
status: active
owner: codex
topic_slug: communication
created: "2026-09-13"
updated: "2026-09-13"
---

Implements P06 under USER-WP-0030-T03 and KEY-WP-0035. Authorized by the
user's P06 request and prior optional-OTP requirement. Existing MFA enforcement
for unrelated clients remains in its current configuration.

## Protect privileged actions independently of ordinary account login

```task
id: USER-WP-0033-T01
status: done
priority: high
```

AAL1 users can reach account/onboarding and authenticator setup. Administrative
browser/API operations require MFA. Policy changes and factor recovery require
recent MFA. Explain step-up, unavailable setup and identity-switch recovery.

## Provide scoped policy preview, confirmed apply, audit and rollback

```task
id: USER-WP-0033-T02
status: done
priority: high
```

Issuer-owned persistent policy state for the two reviewed browser clients only.
Support mandatory and optional-after-enrollment; explicit application AAL2
always wins. Reject ambiguous or unsupported weakening, stale confirmation,
wrong role/audience and replay with altered intent. Durable receipts and guarded
rollback survive issuer replacement. Portal carries verified identity, no admin
credential. Changes affect subsequent authorization, not already issued tokens.

## Verify onboarding and publish the scoped release

```task
id: USER-WP-0033-T03
status: progress
priority: high
```

Test no-factor/password-only, pending/cancel/confirmed enrollment, enrolled OTP,
old AAL1 sessions, mandatory/explicit AAL2, provider outage/recovery, privileged
portal denial and policy preview/apply/replay/rollback. Use actual installed
provider in isolated fixtures, browser tests and native non-mutating readback.
Enable only vergabe-demo-company and user-engine-portal optional policies after
privileged guards pass. Record canonical deployment and rollback evidence.

Resumed after interruption: portal browser 30/30, policy tests 5/5, issuer policy
regressions and rollout tests pass. Installed-provider acceptance Job
`provider-p06-browser-46713f7e` passed native optional/old-session OTP plus five
browser checks. Fixed test endpoint and asynchronous TOTP/detail readiness.
Release and live readback remain in progress. See P06 evidence.