How the core rule works
One client can have only one ACTIVE enrollment across all clinics. If your staff tries to enroll an identity that is active elsewhere, the request is blocked unless you request a transfer.
Tip: In production, connect login to Cognito and remove dev auth.