An owner requests a restricted download; assess role, purpose and expiry rather than account presence alone.
Trusted Records · Platform
Identity, accounts and sessions
Place customers in the correct organization/project and recheck identity before high-risk actions.
Inputs and starting conditions
Authentication policies, configured federation, memberships, project permissions, devices and sessions.
Workflow and control gates
- 01Select method
- 02Authenticate
- 03Select organization / project
- 04Step up when required
- 05Manage / revoke sessions
Sources depict passkeys/security keys, password/OTP/TOTP, OIDC/SAML, VNeID and Entra. VNeID/Entra availability and assurance require integration-rights/configuration verification.
Exceptions and recovery
Expired OTPs/cooldowns, lost passkeys, federation failures, conflicting identity links or expired sessions require controlled recovery. Matching email alone does not authorize linking.
Roles, outputs and states
| Responsibilities | Evidence and states |
|---|---|
| Customers manage factors/sessions; organization administrators manage membership; security approves exceptional recovery and step-up policies. | Identity-link audit, factor/device registries, session history, recovery approvals and revocation receipts. States: active / expired / restricted / revoked. |
Scenario and acceptance criteria
Complete only when
The delivered representation and permitted use have explicit decisions.
Interfaces for this workflow
Integration handoff
End-to-end integration workflows
Connect technical states to business decisions instead of merely listing endpoints.
Read detailsOpenAPI and Swagger Reference
The proposed contract is rendered from one local specification; no network Try-It or real credentials.
Read detailsErrors and next actions
A consistent error envelope guides recovery without disclosing sensitive data.
Read detailsContinue the workflow
Owner progress and access
Owners inspect progress, quality and provenance before accepting outputs.
Read detailsTwo journeys, one records lifecycle
Connect paper and born-digital records through persistent identifiers, policies and evidence.
Read detailsIntegration quickstart
Exercise ingest → job tracking → registration → verification with synthetic data.
Read detailsStart with a verifiable scope.
Agree record classes, quality criteria, permissions and evidence before scaling.
Plan assessment