A new installable candidate adds authenticated human approval, persistent record updates and signed execution outcomes across separate gateway and destination services.
Version 0.2.0-rc.2 is available for technical review. It supports one tenant and one bounded operation: a version-checked JSON record update. Deployment and real Microsoft sign-in qualification remain in progress.
Microsoft Entra support checks the configured tenant, API audience, login application, individual approver, delegated scope and authentication context. The sign-in command uses Microsoft's authentication library and asks the approver to review the exact before-and-after record.
Separate services persist approval and execution state. One-use admission and conditional record writes reject reused approval and stale record versions. Operator-configured keys and real host time replace built-in demonstration authority on this path.
The destination signs its persisted outcome. A lost or invalid acknowledgement remains UNKNOWN until authoritative reconciliation. No blind execution retry is provided.
ATG's own Microsoft directory and the approval API and approver-client registrations have been created. The delegated approval scope, access-token claims and desktop return address are configured, and administrator consent has been granted.
These are setup milestones, not proof of a completed ATG authentication ceremony. The next step is to configure and verify the required MFA/authentication-strength policy, then exercise an actual Microsoft sign-in through the deployed approval flow.
A buyer can configure its own supported tenant. ATG does not require a commercial partner to set up its own qualification environment.
The configured authentication context must be protected by an enabled Conditional Access policy. An authentication-context claim by itself does not establish MFA. Appropriate Microsoft licensing and tenant administration are required.
Microsoft integration and setup guide →These results do not establish a real Microsoft-issued ATG login, production deployment, independent security assurance or customer validation.
This candidate is not production-qualified. No live purchasing, payment, settlement, bank verification or external ERP/CRM connector is implemented. Actual tenant login, deployed TLS, process isolation and independent security review remain to be verified. Directory revocation integration, unattended key refresh, high availability and a hosted approval portal are not included.
The existing local.7 evaluation package and ATG Challenge remain available with their original synthetic-data boundaries. They are separate from this operational candidate. This static website does not run either service or collect login credentials.
Existing evaluation edition →