Secure access
Work email link, Google/Microsoft if configured, or a registered FIDO2 security key. HttpOnly session. No password store.