Lockout policy

When an account locks, for how long, and who is told.

This screen answersUS-54

Acceptance criteria

As an administrator, I want the ability to manually unlock accounts, so that locked users can be recovered under control.

Lockout policy: threshold (failed attempts before soft-lock): 5, Lock duration (auto-unlock): 15 mins, Counter Reset: after every successful login.
Admin can manually unlock a locked account.
Given an account soft-locks 3 times within 24 hours, when the 3rd lock occurs, then it becomes a hard lock requiring admin unlock (no auto-unlock).
Given a hard lock or a suspicious pattern (multiple accounts locking, or one account from many sources), when detected, then an admin is notified via in-app alert and email.
Given a hard lock, when the admin reviews it, then the failed-attempt history (from the audit log) is visible to support the decision.

How an account locks

15 wrong passwords

The account soft locks.

2Wait 15 minutes

It unlocks itself.

33 soft locks in 24 hours

It becomes a hard lock.

4Administrator unlocks

No automatic unlock.

Failed attempts before a soft lock

Lock lasts

Then the account unlocks itself.

Failed attempt counter resets

Soft locks that trigger a hard lock

Within

Two-step code failures

Same rule for the Authenticator or email code.

An account becomes hard lockedSeveral accounts lock within a short timeOne account is tried from many places

Several accounts means

Many places means

In the portalBy email to all administrators