Sign in and organizations
EvalBook has no sign-in of its own. You sign in with your Bookbag account, the organization is the tenant, and people and roles are managed at Bookbag SSO.
EvalBook has no accounts, passwords or invitations of its own. You sign in with your Bookbag account, the same one that opens CodeBook and MadeBook. Your organization at Bookbag SSO is the tenant: every project, trace, dataset, report and audit row in EvalBook belongs to one organization, and nothing crosses between organizations.
Signing in
Sign in on the app's start page sends you to Bookbag SSO (the authorization-code flow with PKCE) and back. EvalBook then keeps a session of its own, bound to the SSO session: if you sign out anywhere in the suite, the EvalBook session ends too (it is re-checked against SSO with a short cache). A session idles out after 12 hours and ends after 30 days at most. No token ever travels in a URL; a deep link carries a resource reference only, and the destination page authorizes you again.
An account is matched by its SSO subject. It is adopted once by an email address only when SSO asserts that address as verified; an unverified address never matches anything.
If your organization has switched EvalBook off at SSO, the app says so on an app disabled page instead of signing you in.
Organizations
The organization selector in the shell lists the organizations you belong to at SSO. EvalBook reads memberships and roles live and keeps no copy of them, so a change at SSO is a change in EvalBook on the next request. EvalBook never manages an organization's members; the shell links to SSO for that.
Organization roles come from SSO: owner, admin, member, viewer. Owners and admins administer every project of their organization without needing a project membership. Everyone else needs a project membership with one or more project roles, which are EvalBook's own. See Roles and access.
An organization has a page of its own in EvalBook (Organizations → your organization) with its settings (the defaults new projects start from), its audit log and its outbox deliveries to peers. Organization owners and admins can read these; the audit log is hash-chained per organization.
Platform administration
EvalBook's platform administrators are the people SSO names in its per-product role for EvalBook (admin). The role is re-read at every sign-in; EvalBook has no screen that grants it. Platform administrators see Admin: readiness detail, jobs across organizations, and the platform-wide audit view. See Platform admin.
Your profile and theme
Your name, email, picture, job title and timezone are read from SSO when a page needs them; EvalBook stores none of them. The theme you pick in the account menu is stored at SSO as a preference, so every Bookbag product opens in the same theme.
Plans
EvalBook is free at launch. It reads your organization's plan from SSO only to show it, and it enforces one limit of its own: the free plan holds three active projects per organization. Archiving a project frees a slot. A plan change never deletes anything: an organization over a limit keeps what it has, and only new projects past the limit wait for a change at SSO. See Projects.