# Authenticated profile contract

- Read the current-user resource before changing profile data and use the server's current concurrency values.
- Change only fields explicitly requested by the user and accepted by the profile tool schema.
- Treat email, password, sessions, recovery information, access flags, tokens and OIDC subjects as sensitive or out of scope.
- Unlink OIDC only on an explicit request and after the server confirms another sign-in method remains available.
- Preserve idempotency requirements and report the persisted server readback without exposing secrets.