---
id: USER-WP-0033
type: workplan
title: "P06 scoped authentication policy and safe optional onboarding"
domain: communication
repo: user-engine
status: finished
owner: codex
topic_slug: communication
created: "2026-09-13"
updated: "2026-09-14"
state_hub_workstream_id: "d49778a4-faca-5712-8db3-1d15a7989aee"
---

Implements P06 under USER-WP-0030-T03 and KEY-WP-0035. Authorized by the
user's P06 request and prior optional-OTP requirement. Existing MFA enforcement
for unrelated clients remains in its current configuration.

## Protect privileged actions independently of ordinary account login

```task
id: USER-WP-0033-T01
status: done
priority: high
state_hub_task_id: "193b737c-f9a0-5d30-8e70-efe7550df258"
```

AAL1 users can reach account/onboarding and authenticator setup. Administrative
browser/API operations require MFA. Policy changes and factor recovery require
recent MFA. Explain step-up, unavailable setup and identity-switch recovery.

## Provide scoped policy preview, confirmed apply, audit and rollback

```task
id: USER-WP-0033-T02
status: done
priority: high
state_hub_task_id: "4e635786-6a68-54a1-b1a1-b73c14fd417f"
```

Issuer-owned persistent policy state for the two reviewed browser clients only.
Support mandatory and optional-after-enrollment; explicit application AAL2
always wins. Reject ambiguous or unsupported weakening, stale confirmation,
wrong role/audience and replay with altered intent. Durable receipts and guarded
rollback survive issuer replacement. Portal carries verified identity, no admin
credential. Changes affect subsequent authorization, not already issued tokens.

## Verify onboarding and publish the scoped release

```task
id: USER-WP-0033-T03
status: done
priority: high
state_hub_task_id: "006b3246-4f54-5989-9126-5ac0b95e226d"
```

Test no-factor/password-only, pending/cancel/confirmed enrollment, enrolled OTP,
old AAL1 sessions, mandatory/explicit AAL2, provider outage/recovery, privileged
portal denial and policy preview/apply/replay/rollback. Use actual installed
provider in isolated fixtures, browser tests and native non-mutating readback.
Enable only vergabe-demo-company and user-engine-portal optional policies after
privileged guards pass. Record canonical deployment and rollback evidence.

Resumed after interruption: portal browser 30/30, policy tests 5/5, issuer policy
regressions and rollout tests pass. Installed-provider acceptance Job
`provider-p06-browser-46713f7e` passed native optional/old-session OTP plus five
browser checks. Fixed test endpoint and asynchronous TOTP/detail readiness.
Release and live readback remain in progress. See P06 evidence.

2026-09-14: P06 completed with CI-published portal and issuer images, provider
guard and scoped client migration. Both services are ready; persistent policy
readback confirms the two optional-after-enrollment clients. Evidence:
`docs/evidence/2026-09-13-p06-authentication-policy.md`. Residual customer sign-in,
user onboarding and workload propagation remain live in USER-WP-0028,
KEY-WP-0034 and VERGABE-WP-0019; this does not close those workplans.