Domains
DNS-TXT verified domains — the tenancy gate. One domain maps to one org.
Two independent proofs gate every org
The hd claim on the employee's silently-obtained Google token proves they work there; the DNS-TXT record proves you're authorized for the org. A domain maps to exactly one org. No capture flows for a domain until verified_at is set.
Verified domains