1. Epic Summary Workspace admins need to require SSO so company security policy is enforced without accidental lockouts. Success: admin can enable SAML SSO requirement with a 7–30 day grace period; after the period, non-SSO password login is disabled for members while the last admin remains recoverable. Non-goals (v1): SCIM provisioning, mobile-native enforcement flows, non-SAML IdPs. 2. User Stories 1. As a workspace admin, I want to connect a SAML SSO provider, so that members can sign in through our IdP. 2. As a workspace admin, I want to require SSO with a configurable grace period (7–30 days), so that the org can transition without an abrupt cutoff. 3. As a workspace admin, I want to see who has not yet completed SSO login during the grace period, so that I can nudge stragglers. 4. As a member, I want clear prompts to complete SSO before password login is disabled, so that I am not surprised by lockout. 5. As a workspace admin, I want protection so the last admin cannot be fully locked out, so that the workspace remains recoverable. 6. As a workspace admin, I want to disable SSO requirement if needed during the grace period, so that we can roll back a bad setup. 3. Acceptance Criteria Story 2 — Require SSO + grace period - Admin can set grace period between 7 and 30 days - During grace period, password login still works with warning - After grace period, password login is rejected for non-exempt users - Attempting values outside 7–30 shows validation error Story 5 — Last-admin protection - System prevents actions that would leave zero recoverable admin access - If policy would lock out last admin, admin sees a blocking error with explanation 4. Out of Scope - SCIM - Mobile app enforcement (web only v1) - Non-SAML protocols - Automatic user provisioning/deprovisioning beyond login method 5. Edge Cases & Risks - IdP misconfiguration during grace period - Users with multiple workspaces and mixed auth - Clock/timezone boundary at grace period end - Admin demotion while SSO enforcement is active 6. Open Questions - Exact behavior for API tokens / service accounts during enforcement? - Who is exempt besides “last admin” (break-glass accounts)? - Email/notification copy and frequency for member nudges?