Staff MFA required, not enrolled
blockedInstructor access is blocked until a safe provider MFA factor is enrolled.
Auth security proof
Staff MFA is role-aware; students stay optional.
Staff MFA enrolled and satisfied
allowedA verified WorkOS factor plus a current MFA completion marker satisfies the staff policy.
Student MFA optional
optionalA student-only active role is not forced through staff MFA, while optional enrollment can still be offered later.
Step-up guard
blockedProtected actions fail closed when auth_time is missing_auth_time.
Session and device metadata
unavailableSigned-out review uses proof data only; real sessions store hashed identifiers and a minimized label like "Chrome browser on macOS".
Default school session policy
- staffIdleTimeoutSeconds
- 1,800 seconds
- studentIdleTimeoutSeconds
- 28,800 seconds
- sharedDeviceIdleTimeoutSeconds
- 600 seconds
- staffMaxSessionLengthSeconds
- 43,200 seconds
- studentMaxSessionLengthSeconds
- 2,592,000 seconds
- stepUpMaxAgeSeconds
- 300 seconds