Placeholder: SSO (OIDC) with mandatory TOTP/WebAuthn per spec 07 §4.4. Provider is an OPEN item for the lead engineer.