Triage only
May see generic case state. Cannot revoke, review or approve.
PHASE 4.1d · SECURITY CONTROL ROOM
See access.
End access.
Marketplace sessions are visible without persisting IP addresses, browser fingerprints or raw provider identity in Marketplace storage. Clerk still processes the selected sign-in method under its own service boundary.
NO ACTIVE SESSION
ACCESS INVENTORY
Your Marketplace sessions
Device names are deliberately generic. This view shows up to five currently active Marketplace sessions and stores no IP address, precise location, browser fingerprint or raw provider ID. Revoke all permanently blocks new Marketplace-session issuance for that account until a future separately reviewed human re-enable ceremony exists, so a concurrent or partially revoked provider session cannot return. Read the privacy and retention notice.
Establish a bounded Marketplace session to inspect and revoke access.
Begin secure accessRECOVERY CEREMONY
Frozen before public use
No email address, phone number, wallet or real account is accepted here. The durable state machine exists with zero cases and cannot restore creator verification, rights, stale Controller Epoch authority, deleted drafts or prior publication decisions.
- 01GENERIC REQUEST ACCEPTED
The response is identical whether or not an account exists.
- 02EXISTING SESSIONS REVOKED
Security response may suspend and revoke; support cannot restore access.
- 03COOLDOWN ACTIVE
A mandatory cooldown prevents instant social-engineering takeover.
- 04INDEPENDENT REVIEW REQUIRED
A separate reviewer records evidence without approving their own work.
- 05PRIMARY METHOD REENROLLMENT
A different approver may permit primary-method reenrollment only.
Suspend only
May suspend and revoke. Cannot restore or approve access.
Two people
The reviewer and approver must be different commitments. AI has no final authority.
Redacted evidence
Append-only events contain allowlisted commitments and outcomes—not raw network or account identifiers.