Status. Proposed design only. Nothing in this vault is DG client approval. No application, service or test has been executed; every scenario is Not executed. Fees and dates are open.
T37 · Authentication, invitation and session controls hold
| Field | Value |
|---|---|
| Status | Not executed |
| Type | Balanced software |
| Layer / kind | API · security · configuration |
| Priority | P0 |
| Gates | A06, A10 |
| Build step | Step-01-Foundation |
| Decisions | Q09 |
Given
DG admin without MFA, expired/used invitations and valid/invalid sessions are available in an isolated test environment.
When
Try protected admin actions without MFA; redeem invitation twice; replay revoked sessions and tampered cookies; send CSRF attempts where applicable.
Then / oracle
MFA protects DG admin operations; invitations are single-use/expire under policy. Sessions and browser mutations are protected; secrets are never returned. Positive authenticated flows remain usable.
Evidence required
Identity-provider test evidence; configuration review; token-redacted request traces.
Decision dependency (verbatim)
Q09: provider, token/session lifetimes and account-recovery policy; no SSO scope assumed.
Source: TDD rev 1.3 (PDF); machine-readable in 10-Sources/tdd-bundle/. Back to Scenario-Index · Traceability-Matrix · integration dependencies in Dependency-and-Regression-Table.