Put it last in a sign-in sequence, after the Classic Error Sound for the failed passwords, with the successful sign-in action immediately after it so the sequence ends on access granted.