Sign in with WorkOS — passkey or email magic link.
The Control Plane SDK authorize() runs in enforce mode — denials produce 403s and are logged to the hash-chained security event chain per spec §7.5. WorkOS AuthKit (ADR-0006) handles identity + MFA; ConfigIQ provisions an identity record on first login keyed by email.