No flow override and no attributes: the realm's own browser flow, which ends both the fresh-login and the returning-session path with the geo guard. Shows the guard's four answers with the exemption off, and that the exemption skips it.
| account \ verdict | SA | GB | SA+vpn | none |
|---|---|---|---|---|
| exempt | admitted | admitted | admitted | admitted |
| not-exempt | admitted | QA023 | QA024 | QA022 |
Your address 216.73.216.102: verdict none (no entry: the stand-in answers 404). The account's exemption: off. Switch them on the lab page.
Guard order: exemption, client bypass, lookup (no verdict: QA022), anonymiser (QA024, whatever the country), country (QA023): qa docs/location-access.md:61-71, src/locationaccess/LocationAccessAuthenticator.java:81-132. The guard ends both paths of the realm's flow browser-enhanced: cfg modules/auth_flows/flows.tf:87-107,171-232; qa docs/location-access.md:86-92 on fahad/docs/location-check-every-login. Allowed countries SA (cfg modules/auth_flows/variables.tf:50); exempt-emails blank (cfg main.tf:463), so only ipPolicyExempt exempts. SA+vpn: the stand-in's vpn flag sets ipinfo is_anonymous (qa tests/lab/ipintel_stub.py:117-118). Lab proof on the same flow: cfg tests/plugins/test_functional_plugins.py:75 (SA admitted, GB QA023), :97 (anonymiser QA024, no verdict QA022), :117 (returning session refused QA023 on the cookie path).