Admin sessions use HttpOnly Secure SameSite cookies. MFA is mandatory before activation. OTP is for registration binding only. Mutations bind to auth APIs and fail closed until providers are validated.