--- title: "Accounts checklist: all 53 rules ยท Agent Wranglers" url: https://agentwranglers.se/playbook/accounts/checklist updated: 2026-10-20 licence: "All rights reserved" --- # Accounts checklist By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20. Every rule in the accounts playbook, by chapter, required rules first. Each links to its own page with how we built it and how to check it. **For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers accounts playbook: https://agentwranglers.se/playbook/accounts/checklist`. ## Sign-up - [ ] **Required** [Ask only for what the first task needs](https://agentwranglers.se/playbook/accounts/sign-up/minimal-sign-up): Ask at sign-up only for the fields the first task needs, usually an email address or a passkey. Ask for anything else when a feature needs it. - [ ] **Required** [Prove the email address before trusting it](https://agentwranglers.se/playbook/accounts/sign-up/email-verification): Mark an email address as verified only after someone opens a link or types a code sent to it. Until then, send no account data there and never use it to link accounts. - [ ] **Required** [Stop strangers from claiming an address before its owner](https://agentwranglers.se/playbook/accounts/sign-up/pre-hijacking): Keep an unverified sign-up pending. When the owner proves the address another way, such as through a provider, drop the pending password, passkeys and sessions instead of merging them. - [ ] **Required** [Compare email addresses and usernames in one canonical form](https://agentwranglers.se/playbook/accounts/sign-up/identifier-normalisation): Store each email address and username as typed, plus one canonical key. Look up, compare and enforce uniqueness on the key only. - [ ] **Recommended** [Reserve names that look official](https://agentwranglers.se/playbook/accounts/sign-up/reserved-names): Refuse usernames, organisation names and subdomains that pose as staff or system pages, or that look like another existing name. ## Sign-in methods - [ ] **Required** [Keep your own user ID](https://agentwranglers.se/playbook/accounts/sign-in-methods/own-user-id): Give every person your own stable user ID and map each sign-in method to it. Never key records by an email address or a provider's user ID. - [ ] **Required** [Verify every passkey answer on the server](https://agentwranglers.se/playbook/accounts/sign-in-methods/passkey-verification): Accept a passkey sign-in only after the server checks the challenge, origin, relying party ID, user flags and signature with a maintained WebAuthn library. - [ ] **Required** [Never remove the last way to sign in](https://agentwranglers.se/playbook/accounts/sign-in-methods/last-sign-in-method): Let people add and remove sign-in methods, but refuse to remove the last one. Never link a provider login to an account by email alone. - [ ] **Recommended** [Decide whether a provider or a library runs sign-in](https://agentwranglers.se/playbook/accounts/sign-in-methods/auth-provider-or-library): Choose a hosted identity provider or a maintained library on purpose, write down why, and never write your own password, token or protocol code. - [ ] **Recommended** [Offer passkeys first](https://agentwranglers.se/playbook/accounts/sign-in-methods/passkeys-first): Offer passkeys as the main way to sign in, through autofill. Invite people to create one right after they sign in another way. - [ ] **Recommended** [Weigh email links before making them the only way in](https://agentwranglers.se/playbook/accounts/sign-in-methods/email-sign-in-trade-offs): Use email links or codes as the only sign-in for low-risk accounts only. Bind each link to the browser that asked for it, and offer a passkey after the first sign-in. - [ ] **Optional** [Keep the password manager's passkey list current](https://agentwranglers.se/playbook/accounts/sign-in-methods/passkey-signals): Tell the browser when a passkey stops working or a user's name changes, with the WebAuthn signal methods, so people stop picking dead passkeys. ## Second factors and recovery - [ ] **Required** [Confirm a second factor before turning it on](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/mfa-enrolment): Turn on a new second factor only after the person proves it works once, and let them give it a name. - [ ] **Required** [Give recovery codes with the first second factor](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/recovery-codes): When someone turns on a second factor, give them 10 single-use recovery codes of at least 64 random bits each, and store only their hashes. - [ ] **Required** [Plan for losing every factor](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/recovery-without-factors): Write down one recovery path for people who lost every factor and every recovery code. Make it slower and louder than sign-in. - [ ] **Required** [Tell people about every change to their sign-in](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/security-notifications): Notify every verified address within 5 minutes of a security change. That means an added or removed factor, a used recovery code, a new email or password, or a new device. - [ ] **Recommended** [Ask everyone to keep two ways in](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/two-authenticators): Prompt each person with one second factor to add another, such as a second passkey or a security key. - [ ] **Recommended** [Let organisations require a second factor](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/org-mfa-policy): Let organisation owners require a second factor for every member, and hold members without one at a setup page. - [ ] **Avoid** [Never use security questions](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/no-security-questions): Never use security questions, or facts such as a birth date or the last digits of a card, to sign in or recover an account. ## Sessions and security activity - [ ] **Required** [Let people sign out of one device or all of them](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity/revoke-sessions): Let people end any one session from the list, or every session but the current one. The ended sessions stop working on their next request. - [ ] **Required** [End sessions when access changes](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity/end-sessions-on-change): End every other session when the password changes or a factor is removed. End every session when the account is disabled, deleted or locked after a "This wasn't me" report. - [ ] **Recommended** [List every signed-in device](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity/session-list): Show each person their active sessions, with device, browser, approximate place, sign-in time and last activity, and mark the current one. - [ ] **Recommended** [List connected apps and personal tokens](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity/connected-apps): Show each person every app, agent and personal token that acts for them, with its scopes and last use. Let them revoke each one. - [ ] **Recommended** [Show people their own security log](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity/security-activity-log): Keep a log of each person's security events and show it to them in settings for at least 90 days. ## Roles and permissions - [ ] **Required** [Check permissions instead of role names](https://agentwranglers.se/playbook/accounts/roles-and-permissions/permissions-not-roles): Make code ask whether a user has a named permission, such as `invoice.refund`. Map roles to permissions in one place, and never compare role names in feature code. - [ ] **Required** [Test every role against every action](https://agentwranglers.se/playbook/accounts/roles-and-permissions/permission-matrix-test): Keep a table of every role and every action with the expected answer, and run it as a test against the server on every change. - [ ] **Required** [Give roles inside an organisation](https://agentwranglers.se/playbook/accounts/roles-and-permissions/org-scoped-roles): Store customer roles on the membership between a user and an organisation. Keep staff roles in a separate store that customer code cannot write. - [ ] **Required** [Make role changes count on the next request](https://agentwranglers.se/playbook/accounts/roles-and-permissions/role-changes-immediate): Apply a removed role or permission within 60 seconds of the change. Never keep roles only inside a long-lived token or cache. - [ ] **Required** [Limit tokens and agents to what their owner may do](https://agentwranglers.se/playbook/accounts/roles-and-permissions/delegated-permissions): Give an API key, connected app or AI agent at most its creator's permissions. Check the creator's current role on every call. - [ ] **Recommended** [Start with roles and add record rules only when needed](https://agentwranglers.se/playbook/accounts/roles-and-permissions/rbac-then-abac): Start with a few roles per organisation. Add conditions on the record only for rules that need them, such as "only the author may edit a draft". - [ ] **Recommended** [Let owners see who can do what](https://agentwranglers.se/playbook/accounts/roles-and-permissions/access-review): Give organisation owners one page that lists every member, role, sign-in method and last activity, with pending invitations, API keys and an export. ## Organisations and teams - [ ] **Required** [Make invitations expire and work once](https://agentwranglers.se/playbook/accounts/organisations-and-teams/invitations): Send each invitation as a single-use link that expires within 7 days, with one role chosen at sending. Let admins see and cancel pending invitations. - [ ] **Required** [Never leave an organisation without an owner](https://agentwranglers.se/playbook/accounts/organisations-and-teams/last-owner): Refuse any change that leaves an organisation with no owner, such as removing, demoting or deleting its last owner. - [ ] **Required** [Transfer ownership only when the new owner accepts](https://agentwranglers.se/playbook/accounts/organisations-and-teams/ownership-transfer): Transfer ownership of an organisation only after the current owner proves who they are again and the new owner accepts. - [ ] **Required** [Remove access when someone leaves](https://agentwranglers.se/playbook/accounts/organisations-and-teams/member-removal): When a member leaves or is removed, end their access to that organisation on their next request, and keep the work they made there. - [ ] **Recommended** [Let organisations own the shared data](https://agentwranglers.se/playbook/accounts/organisations-and-teams/organisation-owns-data): Make an organisation own the shared data, and let one person belong to several organisations. Give even a solo user an organisation of their own. - [ ] **Recommended** [Prove a domain before trusting it](https://agentwranglers.se/playbook/accounts/organisations-and-teams/verified-domains): Let an organisation claim an email domain only after it publishes a DNS TXT record you gave it. Only then may the domain route sign-in or let people join. - [ ] **Recommended** [Keep the organisation in the address](https://agentwranglers.se/playbook/accounts/organisations-and-teams/organisation-in-url): Put the organisation's ID or slug in every address inside it, such as `/acme/invoices/42`, and take the organisation for each request from the address. ## Support and staff access - [ ] **Required** [Use separate staff accounts](https://agentwranglers.se/playbook/accounts/support-and-staff-access/staff-accounts): Give staff accounts that are separate from customer accounts, signed in through company single sign-on with a passkey or security key. - [ ] **Required** [Check who is asking before support changes an account](https://agentwranglers.se/playbook/accounts/support-and-staff-access/support-identity-check): Never change an email, phone number, factor or owner because someone asks by phone, chat or email. Send them to the in-app flow or the recovery process instead. - [ ] **Required** [Impersonate customers only with a reason and a time limit](https://agentwranglers.se/playbook/accounts/support-and-staff-access/impersonation): Let staff view an account as its customer only with a recorded reason, for at most 60 minutes. Make it read-only by default and log it for the customer. - [ ] **Recommended** [Ask business customers before support looks in](https://agentwranglers.se/playbook/accounts/support-and-staff-access/support-access-consent): Let organisation owners grant support access for a set time, and refuse impersonation of their members without a grant. ## Profile and account lifecycle - [ ] **Required** [Keep the old email until the new one is confirmed](https://agentwranglers.se/playbook/accounts/profile-and-account-lifecycle/email-change): Store a new email address as pending until its owner confirms it. Keep sign-in, resets and notices on the old address until then. - [ ] **Required** [Let people delete their account themselves](https://agentwranglers.se/playbook/accounts/profile-and-account-lifecycle/account-deletion): Put account deletion in settings, behind fresh proof of identity, and finish it within one month, as [data requests](https://agentwranglers.se/playbook/website/privacy/data-requests) sets. Say first what happens to the person's data and organisations. - [ ] **Recommended** [Let usernames change without breaking old links](https://agentwranglers.se/playbook/accounts/profile-and-account-lifecycle/username-change): When a username or organisation slug changes, redirect the old address to the new one. Keep the old name reserved for at least 90 days. - [ ] **Recommended** [Let people export their data themselves](https://agentwranglers.se/playbook/accounts/profile-and-account-lifecycle/self-service-export): Offer a download of a person's data from settings, in JSON or CSV, ready within 24 hours. - [ ] **Recommended** [Warn before closing inactive accounts](https://agentwranglers.se/playbook/accounts/profile-and-account-lifecycle/inactive-accounts): Set a written inactivity period for free accounts, such as 24 months without sign-in. Warn twice by email, then delete or anonymise the account. ## Business sign-on and provisioning - [ ] **Required** [Remove access at once when the directory says so](https://agentwranglers.se/playbook/accounts/business-sign-on-and-provisioning/deprovision): When a customer's directory deactivates or deletes a user, end that user's sessions and tokens in the organisation within 1 minute, and keep their work. - [ ] **Recommended** [Connect single sign-on per organisation](https://agentwranglers.se/playbook/accounts/business-sign-on-and-provisioning/organisation-sso): Let each business organisation connect its own identity provider through SAML 2.0 or OpenID Connect, and route its users there by verified email domain. - [ ] **Recommended** [Let organisations require single sign-on](https://agentwranglers.se/playbook/accounts/business-sign-on-and-provisioning/require-sso): Let an organisation require its single sign-on for every member with its domain. Keep one owner with a passkey who can sign in without it. - [ ] **Recommended** [Provision users with SCIM](https://agentwranglers.se/playbook/accounts/business-sign-on-and-provisioning/scim-provisioning): Offer SCIM 2.0, as RFC 7643 and RFC 7644 define it, so a customer's directory creates, updates and removes users and groups. - [ ] **Recommended** [Map directory groups to roles](https://agentwranglers.se/playbook/accounts/business-sign-on-and-provisioning/group-role-mapping): Let organisation admins map their directory groups to your roles, and apply the mapping on every SCIM change and every sign-in. - [ ] **Optional** [Listen for security signals from the customer's provider](https://agentwranglers.se/playbook/accounts/business-sign-on-and-provisioning/shared-signals): Receive OpenID Shared Signals events from customers' identity providers, and end sessions when they report a revoked session or a disabled account.