Accounts checklist

Every rule in the accounts playbook, by chapter, required rules first. Each links to its own page with how we built it and how to check it.

Sign-up

• Required Ask only for what the first task needs
• Required Prove the email address before trusting it
• Required Stop strangers from claiming an address before its owner
• Required Compare email addresses and usernames in one canonical form
• Recommended Reserve names that look official

Sign-in methods

• Required Keep your own user ID
• Required Verify every passkey answer on the server
• Required Never remove the last way to sign in
• Recommended Decide whether a provider or a library runs sign-in
• Recommended Offer passkeys first
• Recommended Weigh email links before making them the only way in
• Optional Keep the password manager's passkey list current

Second factors and recovery

• Required Confirm a second factor before turning it on
• Required Give recovery codes with the first second factor
• Required Plan for losing every factor
• Required Tell people about every change to their sign-in
• Recommended Ask everyone to keep two ways in
• Recommended Let organisations require a second factor
• Avoid Never use security questions

Sessions and security activity

• Required Let people sign out of one device or all of them
• Required End sessions when access changes
• Recommended List every signed-in device
• Recommended List connected apps and personal tokens
• Recommended Show people their own security log

Roles and permissions

• Required Check permissions instead of role names
• Required Test every role against every action
• Required Give roles inside an organisation
• Required Make role changes count on the next request
• Required Limit tokens and agents to what their owner may do
• Recommended Start with roles and add record rules only when needed
• Recommended Let owners see who can do what

Organisations and teams

• Required Make invitations expire and work once
• Required Never leave an organisation without an owner
• Required Transfer ownership only when the new owner accepts
• Required Remove access when someone leaves
• Recommended Let organisations own the shared data
• Recommended Prove a domain before trusting it
• Recommended Keep the organisation in the address

Support and staff access

• Required Use separate staff accounts
• Required Check who is asking before support changes an account
• Required Impersonate customers only with a reason and a time limit
• Recommended Ask business customers before support looks in

Profile and account lifecycle

• Required Keep the old email until the new one is confirmed
• Required Let people delete their account themselves
• Recommended Let usernames change without breaking old links
• Recommended Let people export their data themselves
• Recommended Warn before closing inactive accounts

Business sign-on and provisioning

• Required Remove access at once when the directory says so
• Recommended Connect single sign-on per organisation
• Recommended Let organisations require single sign-on
• Recommended Provision users with SCIM
• Recommended Map directory groups to roles
• Optional Listen for security signals from the customer's provider