# Identity and access flows

- [Signup and registration](signup-registration.md) — A new eligible person creates exactly one usable account, proves required contact points, and reaches the intended first authenticated state.
- [Sign in](sign-in.md) — A valid user establishes exactly one authorized session and invalid, restricted, or abusive attempts fail without leaking account state.
- [Sign out and end session](sign-out-session-end.md) — The intended session or sessions become unusable, sensitive state is cleared, and navigation cannot resurrect authenticated content.
- [Verify email address](email-verification.md) — The rightful controller proves one email address for one account/action without replay, cross-account binding, or stale-link success.
- [Reset forgotten password](password-reset.md) — An eligible user securely proves control, sets a new credential, and invalidates the intended old credentials without account enumeration.
- [Enroll and complete MFA](mfa-enrollment-and-challenge.md) — The rightful user adds a second factor, proves possession, stores recovery options safely, and can complete or recover future challenges.
- [SSO or social login](sso-social-login.md) — A user authenticates through the intended provider, maps to the correct local identity and tenant, and receives only authorized access.
- [Accept invitation](invitation-acceptance.md) — The intended recipient accepts one valid invitation into the correct tenant and role without token replay, address substitution, or privilege escalation.
- [Update profile and account](profile-and-account-update.md) — An authorized user changes permitted identity or preference data, proves sensitive changes, and sees consistent state across sessions and integrations.
- [Delete account](account-deletion.md) — The authorized person understands the consequence, completes required proof, and the account is disabled, deleted, anonymized, or scheduled exactly according to policy.

[Back to all common user flows](../index.md)
