The SWA security model must be explainable before it is convenient

Auto-login for non-SSO apps is handled as part of the access management workflow, not as a convenience-only feature.

• SWA credentials are stored as Lockbox-encrypted data on the server side.
• The extension runs on auto-login target pages, and permission-scope reduction is tracked as a security improvement before production distribution.
• Credential use, autofill failures, and key activity can connect to audit logs.

AxiPass IdP domain models are separated through the Identity namespace and tenant scope.

• Primary Identity models use acts_as_tenant, while audit logs are queried through tenant_id-based scopes.
• Audit logs and app settings are queried by tenant boundary.
• Operator and tenant console authorization boundaries stay separate.

Authentication, authorization, configuration changes, and SWA activity become standard security evidence.

• Events are stored in UTC and displayed in the user's time zone.
• CSV exports and ISMS-P PDF reports support security reviews and internal reporting according to plan eligibility.
• Secrets are not included in logs, flash messages, or redirect parameters.

Joiner, mover, and leaver workflows are managed at the IdP layer to reduce stale accounts.

• Bearer tokens are treated as encrypted secrets.
• Users and Groups endpoints rely on token authentication and tenant boundaries.
• Conflicts and failures leave operator-visible traces.