auth-design

Designs how a system knows who someone is and what they may do — login, sessions, tokens, roles, and permission checks. Use this whenever the user is building login or signup, adding roles or permissions, choosing between sessions and JWTs, integrating OAuth or SSO, or asking how to protect an endpoint. For finding authorization bugs in code that exists, use security-analysis.