Skip to content
Module
Module 5 of 5Lesson 2 of 2~10 min

Exit kit and action plan

The last lesson gathers the course tools so you can reuse them on your product as soon as the following week. You leave with ready-to-use templates and checklists for authentication and permissions, and a 7- and 30-day action plan to put them into practice with your team.

Take this lesson: your first course is freeSee the full syllabus

Lesson objective

By the end of this lesson, you will have the course's templates, checklists and prompts (roles × actions matrix, session table, journey spec sheet, SSO checklist, journey security checklist), and you will have planned how to apply them to your product over 7 and 30 days.

Topics covered

  • authentication kit
  • security checklist
  • specification templates
  • action plan
  • permissions

Where it fits

Specifying and choosing

How do you bring journeys and permissions together in a spec, and should you build authentication or buy it?

Lessons in this module

  1. Specifying the journeys and choosing a provider
  2. Exit kit and action plan (this lesson)

What you will learn in this module

This lesson is part of the course Design authentication and permissions for a product

  • Distinguish authentication, authorization and session, and specify session durations, sign-out and access revocation.
  • Specify password rules and account recovery journeys following current recommendations (NIST SP 800-63B-4, CNIL, OWASP).
  • Choose strong authentication factors (TOTP app, passkeys), plan their rollout and specify the fallback journeys.
  • Specify delegated sign-in (OpenID Connect, social login) and enterprise SSO (SAML, OIDC, SCIM provisioning) for a B2B product.
  • Design a permission model (roles, attributes, scope) as a roles × actions matrix, enforced on the server side according to least privilege.
  • Specify isolation between customers, invitations, the audit log, support access and account deletion.
  • Specify your product's complete sign-in journeys, with states and errors, and choose between building and using an authentication provider.

Related courses