user-engine/workplans/USER-WP-0033-authentication-policy.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	state_hub_workstream_id
USER-WP-0033	workplan	P06 scoped authentication policy and safe optional onboarding	communication	user-engine	finished	codex	communication	2026-09-13	2026-09-14	d49778a4-faca-5712-8db3-1d15a7989aee

Implements P06 under USER-WP-0030-T03 and KEY-WP-0035. Authorized by the user's P06 request and prior optional-OTP requirement. Existing MFA enforcement for unrelated clients remains in its current configuration.

Protect privileged actions independently of ordinary account login

id: USER-WP-0033-T01
status: done
priority: high
state_hub_task_id: "193b737c-f9a0-5d30-8e70-efe7550df258"

AAL1 users can reach account/onboarding and authenticator setup. Administrative browser/API operations require MFA. Policy changes and factor recovery require recent MFA. Explain step-up, unavailable setup and identity-switch recovery.

Provide scoped policy preview, confirmed apply, audit and rollback

id: USER-WP-0033-T02
status: done
priority: high
state_hub_task_id: "4e635786-6a68-54a1-b1a1-b73c14fd417f"

Issuer-owned persistent policy state for the two reviewed browser clients only. Support mandatory and optional-after-enrollment; explicit application AAL2 always wins. Reject ambiguous or unsupported weakening, stale confirmation, wrong role/audience and replay with altered intent. Durable receipts and guarded rollback survive issuer replacement. Portal carries verified identity, no admin credential. Changes affect subsequent authorization, not already issued tokens.

Verify onboarding and publish the scoped release

id: USER-WP-0033-T03
status: done
priority: high
state_hub_task_id: "006b3246-4f54-5989-9126-5ac0b95e226d"

Test no-factor/password-only, pending/cancel/confirmed enrollment, enrolled OTP, old AAL1 sessions, mandatory/explicit AAL2, provider outage/recovery, privileged portal denial and policy preview/apply/replay/rollback. Use actual installed provider in isolated fixtures, browser tests and native non-mutating readback. Enable only vergabe-demo-company and user-engine-portal optional policies after privileged guards pass. Record canonical deployment and rollback evidence.

Resumed after interruption: portal browser 30/30, policy tests 5/5, issuer policy regressions and rollout tests pass. Installed-provider acceptance Job provider-p06-browser-46713f7e passed native optional/old-session OTP plus five browser checks. Fixed test endpoint and asynchronous TOTP/detail readiness. Release and live readback remain in progress. See P06 evidence.

2026-09-14: P06 completed with CI-published portal and issuer images, provider guard and scoped client migration. Both services are ready; persistent policy readback confirms the two optional-after-enrollment clients. Evidence: docs/evidence/2026-09-13-p06-authentication-policy.md. Residual customer sign-in, user onboarding and workload propagation remain live in USER-WP-0028, KEY-WP-0034 and VERGABE-WP-0019; this does not close those workplans.