Authentication

Execution Workflow

1. Choose the identity mechanism first: session, JWT header, JWT cookie, OAuth2 password bearer, or custom middleware based on client and trust boundaries.
2. Attach authentication once at app scope with on_app_init or middleware.
3. Configure exclusion rules explicitly for login, schema, health, and other public routes.
4. Use request.user and request.auth only after authentication has been established.
5. Apply guards separately for authorization checks.
6. Keep missing or invalid credential behavior consistent with the exception-handling strategy.

Core Rules