ELN ID promoted its de facto admin check after an audit found zero ServiceRole users

The shared rule grants two ways. `globalRole === 'ADMIN'` spans every product at once, and `groups.includes('<serviceId>-admin')` is scoped to a single service ID ^[3]. The write-up does not say why none of the seven products used ServiceRole ^[2]. What the platform enforces now is the convention the product teams improvised.

The two bugs share one shape. A refresh path that recomputes group membership with its own code will drop groups the issue path found, and an admin screen with its own predicate will reject users whose API calls the server accepts ^[6].

The silent SSO work is the best documented decision in the write-up. The team first considered the classic hidden iframe, asking in the background whether the user is still logged in, and on real devices the answer was always "not logged in" ^[9]. The cookie ELN ID uses to remember login state is issued with `SameSite=Lax`, and with that setting the cookie is not sent to a window embedded in another site ^[10]. Silent authentication was restricted to a brief top-level navigation to ELN ID and back, embedded iframes were banned, and both were written into the design records ^[11].

The consent design is the part I would copy first. A consent version is an opaque string ELN ID decides, with no meaning attached to its contents, and an integrated product may only check whether two strings match exactly; converting to numbers or comparing order is forbidden ^[12]. The failure that rules out is a product reasoning "version 2 is newer than version 1, so no re-consent needed" and drifting from the IdP's judgment ^[13]. Consent is also kept out of the `id_token`, so every check is a call to the internal `verify-token` API and a character-for-character comparison against the current version ^[14].

Existing consent records were not carried across. Each product had kept its own, copying them risked omissions and mix-ups on top of the labor, and one round of re-consent at first login avoided both ^[15][16]. Consent and silent authentication were built in four stages with test-driven development, and 41 tests passed at the end ^[17]. Those 41 tests cover the four stages the team wrote tests for; the evidence that the seven products now agree about administrators is the two bugs that stopped happening ^[6].

For the promoted rule to transfer, your setup needs what ELN ID's has: one IdP owning group naming, service IDs already namespaced into the group names, and few enough products that codifying the observed check beats converting every codebase. ELN ID is run by one human owner with AI doing the implementation ^[18], it became the shared IdP over three months to June 2026 ^[7], and requests along the lines of "please issue us an OAuth client" came in more than fifteen times in a short period ^[8]. With that ratio, migrating seven products onto ServiceRole was not going to happen.