This is "the application" an end user sees. Sign-in federates through the product's own Cognito pool to the central account — the product never sees a password.