Target authentication architecture for SecurityV0 — portal UI, API, and infrastructure access. Three IdPs (GitHub at L1 perimeter, WorkOS at L2 application, Entra at L3 Azure RBAC), four SSH tiers including a narrow Tier-1.5 emergency key, an Active subscription-Owner Entra account (no PIM, no backup SP — 2nd-human-Owner is the rollback) with Security Defaults MFA-on-sign-in.
How an agent (Claude Code, Codex, ad-hoc curl) authenticates through Cloudflare Access AND WorkOS to hit pr-N-dev / dev / app.securityv0.com.
The single end-to-end overview of how authentication works on the sv0-platform. Read this first if you are a developer or agent landing here. Covers the human (cookie session) and machine (bearer JWT / API key) flows, the four-middleware pipeline, the network perimeter, and where each piece of code lives. Links to the deep-dive docs.
BANKED (2026-06-03) — superseded for now by Tailscale SSH (ADR-023 §3.4.6, sv0-infrastructure#120). Designed-and-reviewed plan for FULLY-UNATTENDED headless ops on dev Azure VMs via a GitHub-Actions OIDC run-command workflow (no local secret), with a tighter run-command-only role. Activate at the first-client/compliance/≥3-operator trigger; prod stays on interactive Cloudflare Access SSH.
Inventory of every credential a Claude Code session in the SecurityV0 workspace touches in a day, with lifetimes, device-bound flags, a single daily morning-routine script, and an analysis of remote-from-iPhone options.
Research artifact: side-by-side comparison of six authentication providers (WorkOS, Clerk, Stytch B2B, Auth0, Cloudflare Access, roll-your-own) across twelve criteria. Informed ADR-017's selection of WorkOS.