Authentication is a set of states, not a single screen. It includes enrolment, sign-in, second factors, recovery, identity changes and sign-out.
Build the map
List possible transitions and the proof required by each. Include mobile applications, APIs, identity providers and legacy flows.
Invariants
Define properties that should always hold: recovery should invalidate previous proof, a sensitive change should require sufficient context and sign-out should end the intended access.
State evidence
Record the identity, channel, issued artefacts and result. Test only with authorised accounts and data.