# Require Bounded CP9 Entries on the Shared Dev Auth0 Client

CP9 session hosts are ephemeral, one-label names under the CP9-owned `cp9.dev.aws.tidbcloud.com` dev zone. The existing shared `tidb-dev` Auth0 application therefore carries exact CP9 callback, logout, and web-origin entries for that hostname wildcard, with fixed `/auth_redirect` callback and `/` logout destinations. This avoids per-session Auth0 mutations and unbounded accumulation: `cp9 up` and `cp9 destroy` keep only read access and report failed UI authentication readiness when any exact CP9 entry is absent.

The application predates CP9 and also serves other development environments, so it already contains broader URL entries outside CP9 ownership. CP9 preserves and tolerates those entries instead of removing them or pretending the shared client is isolated. Its preflight proves only that CP9's own three exact entries exist; it does not certify the full shared application's allow-list. A dedicated CP9 Auth0 application would be required if full client-level isolation becomes a requirement.