Single sign-on, “log in with LinkedIn,” and passwordless email links are making item-bank access easier and quietly changing what your records can prove. When an outside provider verifies who a writer is, your program no longer controls that check. This ePoster reframes modern sign-on as a chain-of-custody question. Using the newly finalized NIST SP 800-63-4 guidelines as plain-language scaffolding, it shows how your session record re-anchors external logins to the actions that follow and what a defensible audit trail must capture if a result is ever challenged.