diff --git a/src/Authority/StellaOps.Authority/StellaOps.Authority/Program.cs b/src/Authority/StellaOps.Authority/StellaOps.Authority/Program.cs
index 73db9b5c7..10802f8a8 100644
--- a/src/Authority/StellaOps.Authority/StellaOps.Authority/Program.cs
+++ b/src/Authority/StellaOps.Authority/StellaOps.Authority/Program.cs
@@ -1814,6 +1814,7 @@ app.UseRouting();
 app.UseAuthorityRateLimiterContext();
 app.UseRateLimiter();
 app.UseStellaOpsCors();
+app.UseIdentityEnvelopeAuthentication();
 app.UseAuthentication();
 app.UseAuthorization();
 app.TryUseStellaRouter(routerEnabled);
diff --git a/src/Authority/StellaOps.Authority/StellaOps.Authority/StellaOps.Authority.csproj b/src/Authority/StellaOps.Authority/StellaOps.Authority/StellaOps.Authority.csproj
index 00ce0e5c6..d06da1185 100644
--- a/src/Authority/StellaOps.Authority/StellaOps.Authority/StellaOps.Authority.csproj
+++ b/src/Authority/StellaOps.Authority/StellaOps.Authority/StellaOps.Authority.csproj
@@ -35,6 +35,7 @@
     <ProjectReference Include="../../../__Libraries/StellaOps.Configuration.AuthorityPlugin/StellaOps.Configuration.AuthorityPlugin.csproj" />
     <ProjectReference Include="../../../__Libraries/StellaOps.DependencyInjection/StellaOps.DependencyInjection.csproj" />
     <ProjectReference Include="../../../Attestor/StellaOps.Attestation/StellaOps.Attestation.csproj" />
+    <ProjectReference Include="../../../Router/__Libraries/StellaOps.Router.AspNet/StellaOps.Router.AspNet.csproj" />
   </ItemGroup>
   <ItemGroup>
     <EmbeddedResource Include="Pages\*.html" />
diff --git a/src/Platform/StellaOps.Platform.WebService/Options/PlatformServiceOptions.cs b/src/Platform/StellaOps.Platform.WebService/Options/PlatformServiceOptions.cs
index 533cffc4d..6a2aad379 100644
--- a/src/Platform/StellaOps.Platform.WebService/Options/PlatformServiceOptions.cs
+++ b/src/Platform/StellaOps.Platform.WebService/Options/PlatformServiceOptions.cs
@@ -177,7 +177,7 @@ public sealed class PlatformEnvironmentSettingsOptions
     public string RedirectUri { get; set; } = string.Empty;
     public string? SilentRefreshRedirectUri { get; set; }
     public string? PostLogoutRedirectUri { get; set; }
-    public string Scope { get; set; } = "openid profile email ui.read ui.admin authority:tenants.read authority:users.read authority:roles.read authority:clients.read authority:tokens.read authority:branding.read authority.audit.read graph:read sbom:read scanner:read policy:read policy:simulate policy:author policy:review policy:approve orch:read analytics.read advisory:read vex:read exceptions:read exceptions:approve aoc:verify findings:read release:read scheduler:read vuln:view vuln:investigate vuln:operate vuln:audit signer:read signer:sign signer:rotate signer:admin trust:read trust:write trust:admin";
+    public string Scope { get; set; } = "openid profile email ui.read ui.admin ui.preferences.read ui.preferences.write authority:tenants.read authority:users.read authority:roles.read authority:clients.read authority:tokens.read authority:branding.read authority.audit.read graph:read sbom:read scanner:read policy:read policy:simulate policy:author policy:review policy:approve orch:read analytics.read advisory:read vex:read exceptions:read exceptions:approve aoc:verify findings:read release:read scheduler:read vuln:view vuln:investigate vuln:operate vuln:audit signer:read signer:sign signer:rotate signer:admin trust:read trust:write trust:admin";
     public string? Audience { get; set; }
     public List<string> DpopAlgorithms { get; set; } = new() { "ES256" };
     public int RefreshLeewaySeconds { get; set; } = 60;
diff --git a/src/Web/StellaOps.Web/src/config/config.json b/src/Web/StellaOps.Web/src/config/config.json
index 8bdbd7275..5515bbd5d 100644
--- a/src/Web/StellaOps.Web/src/config/config.json
+++ b/src/Web/StellaOps.Web/src/config/config.json
@@ -8,7 +8,7 @@
     "redirectUri": "/auth/callback",
     "silentRefreshRedirectUri": "/auth/silent-refresh",
     "postLogoutRedirectUri": "/",
-    "scope": "openid profile email offline_access ui.read ui.admin authority:tenants.read authority:users.read authority:roles.read authority:clients.read authority:tokens.read authority:branding.read authority.audit.read graph:read sbom:read scanner:read policy:read policy:simulate policy:author policy:review policy:approve orch:read analytics.read advisory:read vex:read exceptions:read exceptions:approve aoc:verify findings:read release:read release:write release:publish scheduler:read scheduler:operate notify.viewer notify.operator notify.admin notify.escalate export.viewer export.operator export.admin vuln:view vuln:investigate vuln:operate vuln:audit registry.admin signer:read signer:sign signer:rotate signer:admin trust:read trust:write trust:admin",
+    "scope": "openid profile email offline_access ui.read ui.admin ui.preferences.read ui.preferences.write authority:tenants.read authority:users.read authority:roles.read authority:clients.read authority:tokens.read authority:branding.read authority.audit.read graph:read sbom:read scanner:read policy:read policy:simulate policy:author policy:review policy:approve orch:read analytics.read advisory:read vex:read exceptions:read exceptions:approve aoc:verify findings:read release:read release:write release:publish scheduler:read scheduler:operate notify.viewer notify.operator notify.admin notify.escalate export.viewer export.operator export.admin vuln:view vuln:investigate vuln:operate vuln:audit registry.admin signer:read signer:sign signer:rotate signer:admin trust:read trust:write trust:admin",
     "audience": "/scanner",
     "dpopAlgorithms": ["ES256"],
     "refreshLeewaySeconds": 60
diff --git a/src/Web/StellaOps.Web/src/config/config.sample.json b/src/Web/StellaOps.Web/src/config/config.sample.json
index f5da3275e..db32e8e63 100644
--- a/src/Web/StellaOps.Web/src/config/config.sample.json
+++ b/src/Web/StellaOps.Web/src/config/config.sample.json
@@ -7,7 +7,7 @@
     "logoutEndpoint": "https://authority.example.dev/connect/logout",
     "redirectUri": "http://localhost:4400/auth/callback",
     "postLogoutRedirectUri": "http://localhost:4400/",
-    "scope": "openid profile email ui.read authority:tenants.read advisory:read vex:read exceptions:read exceptions:approve aoc:verify findings:read orch:read release:read release:write release:publish vuln:view vuln:investigate vuln:operate vuln:audit registry.admin signer:read signer:sign signer:rotate signer:admin trust:read trust:write trust:admin",
+    "scope": "openid profile email ui.read ui.preferences.read ui.preferences.write authority:tenants.read advisory:read vex:read exceptions:read exceptions:approve aoc:verify findings:read orch:read release:read release:write release:publish vuln:view vuln:investigate vuln:operate vuln:audit registry.admin signer:read signer:sign signer:rotate signer:admin trust:read trust:write trust:admin",
     "audience": "https://scanner.example.dev",
     "dpopAlgorithms": ["ES256"],
     "refreshLeewaySeconds": 60