docs: freshness security overview (#26520)

## Summary

The security overview treated domain matching as a way to add users and
ended in a card grid. It now describes each sign-in and access option,
and points to the access token, provisioning, and roles pages.

@netlify /security/

Preview: https://deploy-preview-26520--docsdocker.netlify.app/security/

Generated by Cursor Grok

Co-authored-by: Cursor <cursoragent@cursor.com>

content/manuals/security/_index.md

@@ -12,65 +12,50 @@ aliases:
 params:
   sidebar:
     group: Accounts and admin
-grid:
-  - title: Authentication
-    description: >-
-      Two-factor authentication, single sign-on, and OIDC connections.
-    icon: key
-    link: /security/authentication/
-  - title: Access tokens
-    description: >-
-      Personal and organization access tokens for the Docker CLI and
-      automation.
-    icon: lock-closed
-    link: /security/access-tokens/
-  - title: Provisioning
-    description: >-
-      Add users with SCIM, JIT, auto-provisioning, and domain management.
-    icon: arrow-path
-    link: /security/provisioning/
-  - title: Roles and permissions
-    description: >-
-      Assign core or custom roles to control access in your organization.
-    icon: shield-check
-    link: /security/roles-and-permissions/
 ---
 
-Security helps individual users and organization owners secure their
-accounts, manage access, and control membership. You configure these
-settings in [Docker Home](https://app.docker.com/).
+Use these settings to protect your own sign-in, and to control who can join
+an organization and what they can do. You configure them in
+[Docker Home](https://app.docker.com/).
 
-## Individual accounts
+## Secure your account
 
-You sign in with your individual account.
+Docker offers several methods to secure your account. You can choose how you sign in and what the CLI uses instead of your password.
 
 - [Two-factor authentication](/manuals/security/authentication/2fa/_index.md)
-  (2FA) adds a time-based one-time password (TOTP) from an authenticator
-  app to your password.
+  (2FA) requires a time-based one-time password (TOTP) from an authenticator
+  app after you enter your password.
 - A [personal access token](/manuals/security/access-tokens/personal-access-tokens.md)
-  (PAT) authenticates the Docker CLI and tools without your password, and
-  is required for CLI sign-in when 2FA is on or single sign-on (SSO) is
-  enforced.
+  (PAT) signs you in to the Docker CLI and other tools in place of your
+  password. The CLI requires a PAT when two-factor authentication (2FA) is
+  on or single sign-on (SSO) is enforced.
+- [Connected accounts](/manuals/accounts/individual/manage-account.md#manage-connected-accounts)
+  let you sign in with Google or GitHub when the provider account uses the
+  same email address as your Docker account.
 
-## Organization accounts
+## Secure your organization
 
-Organization and company owners set up how members sign in, add them to
-the organization, configure automation, and control what members can do.
+Owners can choose how members sign in, how Docker adds them, and what they can do.
 
 - [Single sign-on](/manuals/security/authentication/single-sign-on/_index.md)
-  (SSO) federates sign-in through your identity provider, which can cover
-  one organization or every organization in a company.
+  (SSO) allows members to sign-in through your identity provider.
 - [Provisioning](/manuals/security/provisioning/_index.md) adds users with
-  System for Cross-domain Identity Management (SCIM), Just-in-Time (JIT)
-  provisioning, auto-provisioning, or domain matching.
+  SCIM, Just-in-Time (JIT) provisioning, or auto-provisioning. Once an SSO connection exists, Docker enables JIT by default, or you can configure SCIM.
 - An [organization access token](/manuals/security/access-tokens/organization-access-tokens.md)
-  (OAT) stays with the organization when membership changes.
+  (OAT) gives automation access on Docker Hub to selected repositories,
+  organization settings, Docker Build Cloud, and Docker Governance. It
+  belongs to the organization, so that access keeps working when people
+  join or leave.
 - [OIDC connections](/manuals/security/authentication/oidc-connections/_index.md)
-  use OpenID Connect to authenticate GitHub Actions with short-lived
-  tokens, as an alternative to a long-lived OAT.
+  let GitHub Actions sign in with a short-lived token instead of a
+  long-lived OAT. Organization owners and editors can create, update, and
+  delete these connections.
 - [Roles and permissions](/manuals/security/roles-and-permissions/_index.md)
   control what members can do after they join.
 
 ## Next steps
 
-{{< grid >}}
+- [Choose a personal or organization access token](/manuals/security/access-tokens/_index.md).
+- [Choose how to add users](/manuals/security/provisioning/_index.md).
+- Compare what members can do in
+  [Roles and permissions](/manuals/security/roles-and-permissions/core-roles.md).