Production behavior is active: CNIC + Authenticator login fills this context automatically. Admin can override; teachers/students are restricted server-side to assigned screens.