account-recovery-reviewlisted

# Account Recovery Review Produce one **Account Recovery Protocol** that restores the rightful user while resisting account takeover, protecting other tenant members, and preserving a clear appeal and correction path. Recovery is an alternative authentication ceremony, not a weaker support exception. ## Atomic boundary Own entry, account-safe discovery, claimant/subject/tenant context, recovery eligibility, proportional proof, risk and cooling, channel orchestration, support or enterprise authority, session/credential containment, restoration, notifications, appeals, post-recovery hardening, audit, and operational evidence. Consume authentication/identity architecture, enterprise ownership, abuse controls, support operations, privacy rules, and incident response from their canonical owners. ## When not to use - Use `product-abuse-risk-review` or `enterprise-access-governance-review` when the primary artifact is cross-product abuse control or enterprise tenant/admin authority rather than recovery of one account's access. - Use `customer-support-operations`, `data-rights-operations-review`, or the owning identity/security engineering procedure for support-organization design, a data-rights case, general authentication architecture, or incident implementation. ## Resource routing - Read `references/recovery-state-and-proof.md` for every task. - Read `references/compromise-enterprise-and-operations.md` for suspected takeover, enterprise/SSO accounts, high-value roles, supp