Specifies trust boundaries, tokens or credentials, abuse controls, expiry, revocation, and threat mitigations for email and password. It fixes adoption boundaries and observable failure evidence while keeping environment-specific limits configurable.