SSO operators can hold permitted non-administrative write capabilities. The guide now checks the actual instance-administration boundary, without instructing a settings mutation or changing roles.
Change-source: pulse-maintainer
Copy generated callbacks only after provider save, align group-claim advice with provider-specific scopes, and retain administrator access until separate-session permission checks pass. Keep shipped documentation and regression checks in step without changing authentication or provider behaviour.
Change-source: pulse-maintainer
Separate browser-cookie lifetime, sliding server sessions and request-driven token refresh. Remove the false provider-change revocation promise, preserve administrator access and document the existing targeted user-removal boundary and private diagnosis.
Contract-Neutral: Documentation and source-consistency tests only; no authentication, session, authorisation or deployment contract changes.
Change-source: pulse-maintainer
pulse-triage[bot]