## TL;DR
Make the target org explicit and verified on every run: load the org URL from a single config value, fetch the org metadata before the first write, and abort if it does not match the expected org. Never let the agent guess the org from context.

## Steps
1. Move the Okta org URL into one config value with no default, so a missing value fails loudly.
   Expected: The agent cannot start without an explicit org.
2. At run start, call the org metadata endpoint and compare the returned org id to the expected value.
   Expected: A mismatch aborts before any write.
3. Include the org subdomain in every audit log line and user-facing message.
   Expected: Operators can see which org was touched.
4. Test by pointing the config at staging and confirming production writes are impossible.
   Expected: The abort triggers correctly.

## When to use
- The agent has credentials for more than one Okta org
- A reset or change landed in the wrong environment
- Staging and production users share the same login names

## When not to use
- Only one org exists in the whole setup
- The agent is read-only
- A human confirms the target org before every run

## Why this happens
Staging and production Okta orgs often share usernames, so a reset against the wrong org looks successful while the real user is unaffected. Agents that infer the org from the ticket or carry a hardcoded default eventually hit the wrong one.

## Edge cases
- Preview orgs created for tests are easy to forget; inventory every org the agent's credentials can reach.
- Org-to-org migration periods are the highest-risk window for this mistake.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_3hVEsA2Q6fSoNyHZytzaOg