/**
 * Fail-closed Origin access lock.
 * Pages stay hidden until origin-access-guard.js unlocks or redirects.
 * If the guard script never loads, origin-access-boot.js sends the browser to sign-in.
 */
html:not(.origin-access-ok) {
  visibility: hidden !important;
  background: #ebe5db !important;
}