Evidence ceiling E3Proof boundary
Developer Documentation
Authentication
Public reads need no credential. Durable institutional tenancy and protected identity-binding controls are implemented and seller-reference-tested; external customer IdP bindings and customer roles remain unprovisioned until institution activation.
Current interface state
Four distinct access states.
Hosting-platform protection and Finality-native institutional binding controls are separate assurance layers.
- PUBLIC
- Read-only public pages and protocol artifacts require no credentials.
- HOSTING-PROTECTED
- SCOPE Qualification redirects signed-out requests through ChatGPT/OpenAI hosting-platform authentication; Eval is separately owner-only under the same platform protection.
- FINALITY-NATIVE IAM
- OIDC/SAML connection validation, SCIM lifecycle, tenant authorization and protected institutional identity-binding controls are implemented and seller-reference-tested; external customer IdP connections and customer roles are not provisioned.
- AUTHORIZATION
- Identity alone never grants a tenant, role, object or action permission.