ADR-023: Authentication Target Architecture
Target authentication architecture for SecurityV0 — portal UI, API, and infrastructure access. Three IdPs (GitHub at L1 perimeter, WorkOS at L2 application, Entra at L3 Azure RBAC), four SSH tiers including a narrow Tier-1.5 emergency key, an Active subscription-Owner Entra account (no PIM, no backup SP — 2nd-human-Owner is the rollback) with Security Defaults MFA-on-sign-in.
Headless agent ops on dev Azure VMs
BANKED (2026-06-03) — superseded for now by Tailscale SSH (ADR-023 §3.4.6, sv0-infrastructure#120). Designed-and-reviewed plan for FULLY-UNATTENDED headless ops on dev Azure VMs via a GitHub-Actions OIDC run-command workflow (no local secret), with a tighter run-command-only role. Activate at the first-client/compliance/≥3-operator trigger; prod stays on interactive Cloudflare Access SSH.