What a sign-in with a provider — Google, GitHub, any SignInProvider plugin — may do, on each provider's register action on MishkaCmsCore.Accounts.User, beside AshAuthentication's own rules (AshAuthentication.Strategy.OAuth2.IdentityChange):

• The email has to be verified by the provider, or nothing happens: an account is found, made and confirmed by that email, so one the provider did not vouch for proves nothing.
• A site's account: the provider's identity, else the email, finds it. With none, one is made only while the site makes accounts this way (SignInProvider.register?/1), takes registrations (AuthGate :register) and is not offline. An account found is held to the site's sign-in gate (AuthGate :sign_in).
• A master — the master site's sign-in page with ?master_user=true, which leaves the request with no tenant: only a master's own identity, else a master's email, signs in. A master is never made this way, and the lookups never reach a site's accounts.
• An account nobody confirmed is claimed by the provider's verified email: confirmed, its password, authenticator and recovery codes removed, and every session of it signed out (:claim_unconfirmed), before the sign-in. Whoever made it without confirming the email, with a password of their choosing, keeps nothing.

An account made by a provider has no password; it can set one later (:set_password). Every account made or found here is confirmed: the provider's verified email is the confirmation.

The provider's tokens are not kept. Nothing here calls the provider after the sign-in, so the identity row holds the provider and its user id and no access or refresh token that a leaked database would hand over. The provider's answer arrives as claims — sub, email, email_verified — as Assent reads each provider's own, and its identity is named after the provider the request ran ("provider/<id>", MishkaCmsCore.Accounts.ProviderStrategy).

Refusals are MishkaCmsCore.Accounts.SocialSignIn.Refused, or the gate's own MishkaCmsCore.Accounts.AuthGate.Closed.