Device approval page

Email change confirmation page showing the new and old address with timestamp and device, a lock account alarm for unauthorized changes, and a dual address notice.

Password reset form that openly explains its anti enumeration response and states reset link timing facts.

Workspace entry page for invited and domain-matched users with a member preview, join or request buttons, and a note that joining is visible to admins immediately.

Account lockout page stating the 15-minute duration, a password reset shortcut, and the reassurance that lockouts are never permanent.

Passwordless sign in showing both the request and sent states with expiry and resend throttle facts.

A required two factor enrollment gate with three method rows ranked by strength, the authenticator app preselected, a grace period deadline, and a skip link.

OAuth connecting state card with a Spinner, three step rows showing progress for a GitHub org link, and fallback links if the page hangs.

Third party app authorization card listing granted scopes and explicit exclusions, the acting account, and authorize or cancel actions with a revoke note.

Centered auth card prompting passkey enrollment with three benefit rows, a device save target panel, and a skip fallback that keeps the existing password active.

A forced password rotation gate with current and new password fields, a policy panel explaining the deadline, and a reset by email fallback.

New password form reached from a reset link with a requirements checklist, a session sign out panel, and the note that nothing changes until save.

Calm session timeout screen that promises local draft restore and prefills the email for one click return.