Manager access

Use Google sign-in with the exact manager email captured during /setup. Passwords are not used.

Unverified or mismatched accounts fail safely and will not unlock manager access or VA /join.