---
title: "Accounts playbook · Agent Wranglers"
url: https://agentwranglers.se/playbook/accounts
updated: 2026-10-20
licence: "All rights reserved"
---

# Accounts and identity playbook

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

An accounts playbook for any web app or SaaS where people sign up, sign in and work together. It covers the product side of accounts. That means how people join, prove who they are, get back in, share an organisation, and leave again.

The attacks on accounts live in the [security testing playbook](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts). It covers password storage, login guessing, session cookies, resets, tokens and single sign-on checks. This playbook links there instead of repeating them. The [website playbook](https://agentwranglers.se/playbook/website/standard-addresses) has the addresses password managers look for, and its accessibility chapter covers sign-in forms.

Start with [Sign-in methods](https://agentwranglers.se/playbook/accounts/sign-in-methods). Choosing a provider or a library decides how much of the rest you build yourself. Teams that sell to businesses should read [Organisations and teams](https://agentwranglers.se/playbook/accounts/organisations-and-teams) and [Business sign-on and provisioning](https://agentwranglers.se/playbook/accounts/business-sign-on-and-provisioning) next.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers accounts playbook: https://agentwranglers.se/playbook/accounts`.

## Chapters

1. [Sign-up](https://agentwranglers.se/playbook/accounts/sign-up): Ask for little, prove the email address before trusting it, and compare names in one canonical form. Then sign-up stays short and accounts stay clean. (4 required, 1 recommended)
2. [Sign-in methods](https://agentwranglers.se/playbook/accounts/sign-in-methods): Pick who runs sign-in, keep your own user IDs, and make passkeys the first choice. Email links and provider logins each need their own care. (3 required, 3 recommended, 1 optional)
3. [Second factors and recovery](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery): Make second factors easy to set up and recovery hard to abuse. Recovery codes, two factors each and a slow, loud last resort keep owners in and attackers out. (4 required, 2 recommended, 1 avoid)
4. [Sessions and security activity](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity): Show people where they are signed in, let them sign out anywhere, end sessions when access changes, and show each person their own security log. (2 required, 3 recommended)
5. [Roles and permissions](https://agentwranglers.se/playbook/accounts/roles-and-permissions): Name permissions in code, map roles to them in one place, and test every role against every action. Then access stays right as the product grows. (5 required, 2 recommended)
6. [Organisations and teams](https://agentwranglers.se/playbook/accounts/organisations-and-teams): Let organisations own the data, invite people safely, never leave a team without an owner, and cut access the moment someone leaves. (4 required, 3 recommended)
7. [Support and staff access](https://agentwranglers.se/playbook/accounts/support-and-staff-access): Give staff their own accounts and check callers before changing anything. Support sees a customer's view only with a reason, a time limit and a trail. (3 required, 1 recommended)
8. [Profile and account lifecycle](https://agentwranglers.se/playbook/accounts/profile-and-account-lifecycle): Change emails and names without losing anyone, let people export and delete their account themselves, and close unused accounts only after warnings. (2 required, 3 recommended)
9. [Business sign-on and provisioning](https://agentwranglers.se/playbook/accounts/business-sign-on-and-provisioning): Let each business customer bring its own identity provider, add and remove users through SCIM, and act on the security signals it sends. (1 required, 4 recommended, 1 optional)

See all 53 rules on one page in the [checklist](https://agentwranglers.se/playbook/accounts/checklist).