Authenticated flows are where most CI test suites quietly give up. Someone hardcodes a 'test admin' password, MFA gets disabled 'just for QA', and six months later that account is the entry point for a real incident. There's a better path.
Store TOTP seeds, not passwords
Assertive's Secret Vault encrypts TOTP seeds with AES-GCM and derives one-time codes at run time. Scenarios reference them as {{secret.MFA_SEED}} — never the raw value. Logs, screenshots and public run reports all mask them by default.
Ephemeral personas beat shared accounts
For flows that mutate state (checkout, invites, role changes), provision a fresh persona per run. Assertive's persona generator produces realistic identities with pre-registered MFA, then tears them down after the report is filed.
The CI pattern
Trigger runs via POST /api/v1/runs/trigger with an ASSERTIVE_API_TOKEN stored as a GitHub Actions secret. The agent resolves personas, unlocks vault secrets inside the run sandbox, and returns a signed report URL. No plaintext ever leaves the vault boundary.