Authentication

Distinct from authorisation, which is what they may do, and the two are worth keeping separate in both conversation and code — a great many vulnerabilities are an authorisation check that was skipped because authentication succeeded.

The strength of the claim varies and should be explicit: a password is one factor and phishable; adding a TOTP code is two factors and still phishable; a passkey or hardware key bound to the origin is phishing-resistant. High-value actions can demand step-up authentication rather than treating the whole session as uniformly trusted.

Architecturally the decisions are: where authentication happens (once at the edge, with identity propagated inward, is the usual answer), how the resulting session is represented (opaque token with server-side state, or a signed token), and how revocation works — which is the question that decides between the two.