Auth Entry

Pavri supports two dashboard entry modes:

• Local credentials for local development, evaluation, and self-hosted installs that are not using WorkOS SSO
• WorkOS-backed SSO for deployments that route sign-in through an identity provider

Support status

Area	Status	Notes
Protected-route redirect to /login	Available	Unauthenticated users are redirected before entering the dashboard shell.
Local username/password sign-in	Available	Used when WorkOS is not enabled.
WorkOS SSO entry	Available	The login screen routes users into the IdP flow when WorkOS is enabled.
SSO failure retry screen	Available	state=error renders an SSO retry/support screen instead of a dead-end credential form.
Invite acceptance	Available	Invite flows are supported for tenant members.
Password reset / provider-specific recovery	Deployment-dependent	SSO tenants use their IdP recovery flow; local-auth deployments use the Pavri reset flow when enabled.

What users see

• Unauthenticated requests to protected dashboard routes redirect to /login.
• Successful sign-in lands inside the dashboard shell, typically on Agents unless a specific next route was requested.
• If WorkOS is enabled, the login page presents an SSO-first entry experience.
• If the SSO flow fails and returns with state=error, the user now sees:
  • an explanation that SSO failed
  • a Retry SSO action
  • a support path

Pavri no longer renders a local credential form in WorkOS mode just because state=error is present.

Role-aware behavior after sign-in

Pavri currently separates post-login access into three dashboard roles:

Role	Typical access pattern
Admin	Full tenant access including members, tenant settings, detection configuration, policies, alert rules, and reports browse/export
Security Analyst	Operational and governance access including policies, alert rules, discovery, MCP review, protection profiles, and reports browse/export
Viewer	Read-only operational access with explicit denied/read-only states on protected write surfaces

The product now prefers explicit Access denied and Read-only states instead of silent redirects when a signed-in user reaches a page outside their role.

Local development

Local and test deployments may provide non-production accounts through the deployment owner. Pavri does not publish account credentials in customer documentation.