Auth Flow Design

Core Workflow

1. Identify actors, clients, trust boundaries, data sensitivity, and existing identity provider or auth stack.
2. Separate authentication, authorization, session/token handling, and audit requirements.
3. Define flows for login, token issuance, refresh, logout/revocation, service access, permission checks, and failure behavior.
4. Specify where checks happen: gateway, middleware, service layer, database, or external provider.
5. Document abuse cases, least privilege, tenant isolation, and review gates.
6. Include tests and operational checks for auth regressions.

Safety Rules