SINGLE SIGN-ON EVALUATION WORKSHEET
Original fictional BriefRelay enterprise-customer scenario. Checked October 28, 2026.
This is a planning worksheet and diagram exercise, not an identity-provider setup or completed authentication test.

EXAMPLE CONTEXT
A fictional design agency wants its staff to reach BriefRelay using its managed identity provider.
BriefRelay already owns application sessions and workspace-scoped permissions.
The customer asks about SAML or OpenID Connect, account creation, removed access and recovery.
No customer's actual identity configuration, account or contract is represented.

IDENTITY AND TRUST
Customer workspace:
Customer identity-provider owner and backup:
Application owner and support contact:
Supported protocol and maintained integration:
Expected issuer and intended application audience:
Registered redirect / assertion-consumer endpoint:
Transaction binding and callback validation performed by the integration:
Stable user-identity mapping:
Existing-account linking policy and who may approve it:
How the customer workspace is bound to the identity configuration:
Signing keys/certificate discovery and rotation owner:
Required authentication policy and where MFA is enforced:

APPLICATION LIFECYCLE
When is an app account created?
Is just-in-time creation permitted, or is provisioning required first?
How are user updates and removals propagated?
What role does a new account receive, and who approves changes?
What membership/session freshness is required for sensitive actions?
What happens to an existing app session when the identity-provider session ends?
Which logout operations are supported by the chosen integration?
Who owns a failed or uncertain identity mapping?

ROLLOUT PLAN
Bounded test tenant and synthetic accounts:
A separate recovery/admin path with an authorized owner:
Current accounts and mapping/migration assumptions:
Pilot users and the agreed success observations:
Sign-in denial, invalid response and unavailable-provider cases:
Removed user, changed group and existing-session cases:
Evidence location and access:
Support handoff:
Rollout decision owner, decision and date:
Rollback/recovery decision and trigger:

EXERCISE WALKTHROUGH
1 A synthetic agency user opens BriefRelay.
2 The app starts a transaction using the configuration bound to that customer workspace.
3 The browser visits the identity provider; it may reuse an eligible session or require authentication.
4 The protocol-specific response returns through the registered flow.
5 A maintained integration validates the response and transaction for this app.
6 The app resolves the user/account mapping and creates the permitted local session.
7 The requested operation still checks workspace membership and application permission.

SSO is not a grant of every application permission. Provisioning, MFA and application authorization require their own decisions.
A successful sign-in screenshot alone does not verify removal, account linking, logout, callback checks or tenant isolation.