User: Access Portal

Enter Credentials (SSO OIDC or Email+Password)

MFA Enabled?

Bypass MFA (Trusted SSO Policy)

MFA Challenge (TOTP / SMS)

MFA Success?

Access Denied (Account Lock after N attempts)

Role Resolution (Maker / Auth / Admin)

Session Issued (30m idle) Redirect to Dashboard

No

Yes

No

Yes