Every login runs IP rate-limit → lockout → credentials → device check, all audited.
Four automatic gates, one linear spine.
Every credential submission passes through a rate-limit check, a lockout check, a credentials and MFA check, and a device-fingerprint check before a session is granted. Each failed gate branches off the spine; the happy path stays straight down.
Every login clears four automatic gates. IP rate-limit blocks flooding, lockout stops brute-force, credentials + MFA verify identity, and a device fingerprint flags unfamiliar sessions — each failure branches off the spine with its own outcome, all events written to the audit log.