Cloudflare Access gates the whole domain against this Google identity. Session refreshes every 24 hours; sign out forces a fresh SSO flow.
Delete conversation history or purge the Vault. Both actions are stubbed for MVP-1 — intentionally disabled until the confirm modals land in MVP-2.