---
id: USER-WP-0026
type: workplan
title: "Account recovery and visible identity and access"
domain: communication
repo: user-engine
status: active
owner: codex
topic_slug: user-engine
created: "2026-09-12"
updated: "2026-09-12"
---

The operator reports a dead-end authentication error after using an account
outside the product tenant. Recent issuer telemetry indicates token exchange
failure; tenant rejection and provider failure must not be conflated.

## Implement and validate recovery

```task
id: USER-WP-0026-T01
status: done
priority: high
```

Route failed browser login to the public account recovery surface without codes,
state or unverified identity. Show verified portal identity, tenant memberships,
and recorded workload memberships; preserve operator/customer separation.
Provide CSRF-protected portal logout and confirmed shared provider sign-out with
fixed owner-configured return locations. No automatic reauthentication loops,
MFA downgrade, global JWT revocation claim or inferred workload entitlements.

## Publish and verify the recovery flow

```task
id: USER-WP-0026-T02
status: progress
priority: high
```

Publish immutable images, update canonical runtime pins, verify anonymous
recovery and sign-out confirmation live, and record actual account switching
only after browser evidence. Existing application sessions may outlive provider
logout. Related: USER-WP-0025-T03 and VERGABE-WP-0019-T06.

Source verification: 182 tests passed with three optional integration skips; layer conformance passed. Immutable publication and live checks are in progress.