As an anonymous client, supplied fresh product-fixed ESP, plain/base64/gzip and unsigned-JWT SSO tickets for `su`, forged `AL_CONTROL` role commands in multiple encodings, activated the advertised `portal-redirect` dynamic step, and attempted its goto. All paths retained `guidewire_pc` password state and the Guidewire identity route still redirected to login. Target-specific signed/encrypted SSO ticket keys were not available.