# Sign in

**Flow key:** `sign-in`

## Outcome

A valid user establishes exactly one authorized session and invalid, restricted, or abusive attempts fail without leaking account state.

## Actors

- Registered user
- Identity service
- Risk/abuse controls
- Optional identity provider

## Preconditions and entry points

- An active verified account exists.
- Known invalid, locked, disabled, and other-tenant identities are available.
- Session and lockout policies are known.

## Required test data

Use synthetic, isolated, resettable data. Never use real credentials, payment instruments, private customer records, or production notifications.

| Data | Canonical valid seed | Critical variations |
|---|---|---|
| Valid account | `carbon.login+001@example.test` | username alias, mixed case, Unicode, multiple tenants |
| Credential | Correct synthetic password | wrong, empty, expired, reset, whitespace, password-manager fill |
| Account states | active and verified | unverified, locked, suspended, disabled, deleted |
| Session state | signed out browser | already signed in, expired session, remembered device, parallel tab |

## Canonical steps

Treat this as the ordinary successful path inferred from common product behavior. Adapt it to observed labels, business rules, APIs, and implementation evidence; do not invent a requirement.

| Step | User or system action | Expected evidence |
|---:|---|---|
| 1 | Open the sign-in entry point. | Identity and credential fields, recovery, signup, and SSO choices are understandable. |
| 2 | Enter the valid identity and credential. | Secret remains masked and password-manager/autofill behavior is correct. |
| 3 | Submit once. | The server authenticates, applies risk policy, and creates one session. |
| 4 | Complete MFA or step-up challenge when required. | Challenge is bound to this attempt and safe recovery remains available. |
| 5 | Reach the authorized destination. | User, tenant, role, return URL, session lifetime, and navigation agree. |
| 6 | Access a protected resource and refresh the page. | Authorization persists only within the intended session policy. |

## Alternate paths

- Passwordless or magic-link sign in
- SSO/social sign in
- Tenant selection after identity
- Remember-me session
- Step-up authentication for sensitive destination

## Failure and recovery paths

- Wrong/unknown identity responses reveal account existence
- Rate limit or lockout enables denial of service
- MFA provider is unavailable
- Session creation succeeds but redirect fails
- Stale return URL targets an unauthorized destination

## Completion oracle

- The stated outcome is true in visible UI and authoritative persisted state.
- Exactly one intended business result and no unintended side effect occurred.
- Identity, tenant, authorization, money/data, lifecycle, notifications, integrations, analytics, and audit agree where applicable.
- Refresh, retry, back/forward, and a second authorized read do not reveal a contradictory result.
- Any partial, delayed, canceled, failed, or unknown outcome is labeled truthfully and has a safe recovery path.

## Evidence to capture

- Entry context, actor, tenant, role, feature flags, locale, time zone, and initial identifiers/state.
- Step-level screenshots or DOM state plus request/response, correlation, job, event, and stable business IDs where available.
- Before/after authoritative records, versions, totals, permissions, lifecycle states, and downstream side effects.
- Notifications, audit events, integration deliveries, retries, deduplication, latency, and recovery evidence.
- Untested branches, unsafe-to-run cases, product decisions, and evidence tier.

## Product decisions to resolve

- Exact eligibility, required data, authorization, and validation rules.
- Which steps are synchronous, asynchronous, optional, skippable, reversible, or irreversible.
- Idempotency, concurrency, timeout, retry, cancellation, and compensation semantics.
- Retention, privacy, notification, audit, performance, accessibility, and localization commitments.

## Related CARBON items

- [login](../../items/identity/login.md)
- [username](../../items/controls/username.md)
- [password](../../items/controls/password.md)
- [mfa and one time codes](../../items/identity/mfa-and-one-time-codes.md)
- [session lifecycle](../../items/identity/session-lifecycle.md)

[Back to Identity and access flows](index.md)
