Portal sign-in itself is enforced by Cloudflare Access (named person, one-time PIN).
A person needs BOTH an Access policy entry (Cloudflare side) and a row here (application side).
Until the UES shareholder representative is designated, the portal is internal only (STD-0113 PL-003).
