SECURE SESSION · HttpOnly BFF cookie · server authorization enforced
Sovereign control plane
StratoID / Control plane

New CA policy

Build a rule: who and where it applies, then the decision to enforce.

1 · Identify the policy

Lower runs first.

2 · Conditions

Leave a condition empty to match everyone on that dimension.

ISO country codes.

3 · Decision

Who this affects

Live preview based on current conditions.

0

of 0 users match no group filter (everyone). Country and network conditions are evaluated per-request at sign-in time.

Resulting decision:require mfa

Policies are evaluated in ascending priority order; the first policy whose conditions match a request determines the decision. Test the full pipeline in Access Explorer after saving.