Thesis: Hosted sign-in can attach document links. It cannot host the full counsel strip. Wrong green is “terms configured” when the strip operators expect never appears.
What we shipped first
The console accepted a privacy URL and a terms URL. That looked complete. Reviewers still asked where Security and Access help lived. Invite-only flows often never show Privacy or Terms on sign-in — only on sign-up — so even those two links can stay invisible.
We nearly treated the Managed Login setting as the counsel surface. It is not. The hosted page will not render a multi-link strip with an agreement sentence under the form.
The working shape
Keep Privacy and Terms on Managed Login when the product wants them there. Put Security, Access help, and the agreement sentence on the app login stubs / app shell — the surfaces we own. Do not invent a green check from “URLs saved in Cognito.”
# Hosted sign-in can attach document links only
privacy_policy_url = https://app.example.com/legal/privacy
terms_of_use_url = https://app.example.com/legal/terms
# Often shown on sign-up — invite-only pools may never surface them on sign-in
# Hosted UI still cannot render the counsel strip:
# Security · Access help · agreement sentence
# Those stay on the app login stubs / app shellChecklist
- Expect Managed Login to carry Privacy and Terms only — often on sign-up, not every sign-in.
- Ship Security · Access help · agreement sentence on login stubs in the app shell.
- Walk an invite-only sign-in once; confirm what the hosted page actually shows.
- Do not close counsel work because the Cognito fields are filled.
Related: HttpOnly cookies do not help if /auth/session returns the refresh token. How we deliver: methodology.
Engineering commentary only — not audit, legal, or certification advice.