For AI agents: llms.txt is a short guide that sends you to the rules your problem needs, and rules.json holds every rule of this playbook as JSON.

Applies when

The project it has user accounts.

How to do it

NIST SP 800-63B-4 says a password is chosen by the person or assigned at random by the service. A password an admin typed is known to two people, and it often travels by chat or email. Give the "add member" form an email field and a role, then send an invitation. Let a "reset sign-in" button send the member a reset as make password resets safe builds it. Leave the old password working until the member sets a new one. Write an audit event for each reset an admin starts.

Examples

Using these examples: they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

JavaScript example

app.post('/org/:orgId/members/:userId/reset-sign-in', requirePermission('members.manage'), async (req, res) => {
  const member = await members.find(req.params.orgId, req.params.userId);
  if (!member) return res.sendStatus(404);
  await passwordResets.sendTo(member.userId);
  await audit.append({ organisationId: req.params.orgId, actor: req.user.id, type: 'member.reset_started', subject: member.userId });
  res.sendStatus(202);
});

Python example

@app.post("/org/<org_id>/members/<user_id>/reset-sign-in")
@require_permission("members.manage")
def reset_member_sign_in(org_id: str, user_id: str):
    member = members.find(org_id, user_id)
    if member is None:
        abort(404)
    password_resets.send_to(member.user_id)
    audit.append(organisation_id=org_id, actor=current_user.id, type="member.reset_started", subject=member.user_id)
    return "", 202

How to check

The add-member and edit-member forms have no password field. Call the admin reset endpoint for a test member. The response holds no password or link, and the member's inbox gets the reset email.

Sources

• NIST SP 800-63B-4 on password authenticators

Related rules

• Make invitations expire and work once in Accounts
• Make password resets safe in Security testing
• Write an audit event for every sensitive action in Compliance