Session boundary
server-side session lookup before scoped data access
ST
Soundtoscript
Secure account access
Access paths
clients may sign up or sign in with email/password and can link a verified guest order
admins are provisioned by a super admin or system operator before they can sign in
workers and QA reviewers cannot self-register; an admin must create or invite the account first
Accept Worker InviteGuest order linking
guest quote, upload, and verified payment may be linked to a lightweight client account after payment confirmation
Review Client SignupAuthentication setup
Email/password sign-in uses database-backed credentials. Google sign-in is hidden until its OAuth credentials are configured.