Hi, I’ve just set up an application with ash_authentication. There is only magic link strategy for now, so there is no confirmation add on yet. Official guide don’t set prevent_hijacking? explicitly, but it defaults to true. How it is supposed to work with email change?
If you want to support email changing with that setup, I don’t believe the default gives you a way to do that. You’d need to introduce a confirmation add on, and leverage that for changing the email. I’m not fully sure I understand the question/confusion so please feel free to elaborate 
