How do I secure authentication and authorization?
- Authentication: MFA or passkeys for privileged roles, strong password hashing, session rotation and revocation, rate-limited recovery flows
- Authorization: *deny by default*, with object-level and function-level checks on every route, server action and batch endpoint — never trust the client for identity
- Tenant isolation enforced in code and, as defence in depth, with database Row Level Security
- Least privilege for people, services and database roles
- Negative tests: prove user A cannot read or change user B's data (horizontal) or reach admin functions (vertical)
- Anti-enumeration and bot protection on login, sign-up and reset
- Detection: alert on privilege changes, mass downloads and failed-login anomalies