RV/sign in
Anonymous entryNo account linkage
Privacy-mode invitation
Redeem an anonymous invitation code from your Data Steward. RV activates a scoped role without exposing recipient labels, direct identifiers, or capability proofs to the browser UI.
Code handlingONE USEconsumed server-side
Proof pathHTTPONLYnot rendered to client
DisplayROLEscope only
Next gateCONSENTif required
Recipient labels stay out-of-band or inside an encrypted vault; they are never stored in RV plaintext fields.
INVITATION BLINDRedeem code
Server mints an opaque capability proof and stores only hashes.
Activate role
An HttpOnly capability cookie is set; RV displays only role and scope.
Consent gate
Research workflows stay locked until the active capability consents.
Flow contract
operator-safeThe visible form accepts only the invitation code. Server responses are sanitized to role, scope, consent, and next-step labels. This path activates a scoped capability only; it does not unlock the account-backed identity vault.
Ref concealedProof concealedCookie scoped