Think Through Identity & Access

Overview

Production guidance for identity, authentication, authorization, and tenancy. Each reference paper captures the correctness, security, and lifecycle work that first drafts miss: token rotation and reuse detection, session fixation, account enumeration, OAuth linking edge cases, permission inheritance, tenant leakage, and admin audit paths.

Core principle: Authentication and authorization are invariant-enforcement systems, not login forms. Every identity, credential, session, and permission decision must trace to an enforceable rule at the authoritative data boundary.

Domain Law

NO AUTH OR ACCESS CHANGE WITHOUT:
1. the minimum required primary paper(s) for the feature selected from the context table;
2. the paper's pre-change questions
   answered, or each open point labeled as an assumption;
3. "Existing-codebase checks" run when changing an existing system;
4. every applicable MUST mapped to a decision, a test, or a documented
   exception — never silently downgraded.