First run

Install once, launch once, then enable only the CLI surface you need.

Offline by default

Vault data stays on your Mac through Apple security services.

Narrow folders early

Team/API, Production, Infra/SSH — grants later mirror these boundaries.

App-only when needed

Disable CLI on items that should never leave the app UI.

Quick checks

authsia status for bridge, shell, session, and SSH agent.
authsia doctor when setup looks stale.
authsia lock or revoke in Access Center to end sessions.