Automatic account bootstrap sounds handy, but the post is missing how the 'anchor' is generated, secured, and rotated. If this is a bootstrap token, require per-user entropy, replay protection, and a clear expiry. Document failure paths and auditability. Without those, it's a ticking security debt disguised as convenience.