Operations Portal
Single sign-on through the wasl identity provider. Role-based access, immutable audit logging, just-in-time elevation.
SSO mock — Azure B2C / OKTA stub. Use a seeded operations account.