"Any User" Petitioner Enrollment Authorization

Having an "Any User" enrollment flow authorization would allow authentication to take place up front (for self signup enrollments), rather than after email confirmation. This would also allow duplicate org identity checks to take place before any operational identities have been created (either in selectEnrollee or perhaps a new selectOrgIdentity step).

If an org identity were selected, then perhaps don't prompt for (or ignore collected) org identity attributes, or pre-fill them with current values and then merge updates into the existing record. With this configuration, the recommended options might be require confirmation of email but NOT require authentication (since the identifier would already be collected).