> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cyberopsource.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication & SSO

> High-level overview of authentication and session protection in Compliance OS.

# Authentication & SSO

Compliance OS uses authenticated identities and signed client context to help ensure that a user operates within the correct organization and authorized applications.

## Identity

Users authenticate through an approved sign-in method configured for the environment. Depending on the client and deployment, this may include password-based or federated identity options.

Authentication establishes who the user is. It does not by itself grant access to every Compliance OS client, engagement, or application.

## Client context

After sign-in, the platform verifies the client context associated with the portal being accessed. This helps bind the session to the organization the user is actually trying to enter.

## Application authorization

Child applications such as the Interview Application, Remediation Workspace, and Security Program Hub perform their own authorization checks.

The Client Portal therefore does not act as a universal authorization bypass.

## Session protection

Compliance OS uses signed session information to carry trusted client context between coordinated applications. Verification applications validate the session rather than trusting client-supplied identifiers.

At a high level, the model is intended to bind the session to:

* the authenticated user,
* the client,
* the client portal context,
* authorized data context.

Sensitive signing material is handled separately from normal client code and configuration.

## Security expectations for users

Users should:

* protect their sign-in credentials,
* use approved devices and networks where required,
* avoid sharing accounts,
* sign out from shared devices,
* report suspicious login behavior,
* never send access tokens or one-time codes through support messages.

## SSO does not mean unlimited access

Single sign-on improves the user experience across coordinated applications. It does not remove application-specific authorization or client isolation controls.