# Use A Prepared Seed Identity For Primary UI Login

The primary CP9 browser proof uses one designated seed identity that is prepared on both sides of the login boundary: its email/password identity already exists in the shared tidb-dev/us Auth0 tenant, and the same email is idempotently prepared as an ACTIVE user with the required org role in the current Session Account data. Auth0 remains the password owner; per-session CP9 lifecycle never creates or resets the Auth0 identity and never stores credentials in configuration, status, logs, or evidence. CP9 also does not infer the seed from the session owner or enable unrestricted just-in-time Account creation for arbitrary tidb-dev users. This provides a deterministic normal-login path while keeping shared identity mutation and broad access expansion outside Session startup. The registration UI and routes remain present, but functional registration-to-login is a separate next browser slice rather than part of this primary acceptance path.