Authentication and roles determine who may read or change data; hiding a button is not enough. I implement sign-in, account recovery, sessions, forms, and a server-side permission model based on real responsibilities.
Work starts with a role–action–object matrix, then selects passwords, magic links, OAuth, or a corporate provider. Scope includes server checks, errors, session protection, sensitive-action auditing, and critical-path tests. Acceptance covers expired links, revoked roles, concurrent edits, and valid drafts in multi-step forms. MFA and regulatory requirements must be explicit.
