1. Your identity providerWho is this? The token or password is verified first.
2. Work admissionDo they belong here? Disabled accounts, directory pins, verified email, the lists, an invitation.
3. The accountLink to a known sign-in, or create one.
4. A sessionlw_session, renewed while in use

• Refused at admissionA 403 page and an auth.denied audit row. No account is written.
• Checked again laterEvery renewal and every device sign-in asks the admission question again.