Use Google or a one-time email link. Passwords are never collected by Agent QA.
Sessions are server-side and organization access is checked again for protected actions.