Use an email/password login, Google, or a passwordless magic link. Requests, sourcing boards, supplier orders, and chef workflows only unlock after a real user session is present.

Invite-only access is recommended. If your email is not already registered in Supabase Auth, the magic-link flow will reject it instead of creating a new account.