AUTHENTICATION_FLOW

Category: 09. Cybersecurity
Section: Phase 2: Technical Blueprint

7. AUTHENTICATION_FLOW.md

Purpose: To define identity, access control, MFA, and zero-trust principles.

You are a senior identity and access management engineer.
Using the PRD and System Architecture below, create an Authentication and Access Control document for a cybersecurity hackathon project.

PRD: [PASTE PRD]
ARCHITECTURE: [PASTE SYSTEM_ARCHITECTURE]

Provide:
1. Authentication methods (Password, MFA, SSO, Biometric)
2. Password policy (Complexity, Expiry, Hashing)
3. Multi-factor authentication (TOTP, SMS, Hardware key)
4. Authorization model (RBAC, ABAC, Zero Trust)
5. Role definitions (Admin, Analyst, User, Guest)
6. Session management (Timeout, Refresh, Revocation)
7. API authentication (JWT, OAuth 2.0, API keys)
8. Identity providers (Okta, Auth0, Keycloak)
9. Audit logging (What to log, Where to store)
10. Common authentication vulnerabilities (OWASP)
11. A checklist for verifying authentication before the demo

Keep the authentication simple and secure enough for a hackathon.
Explain concepts in beginner-friendly language.