---
name: authentication-and-authorization
description: Review login, sessions, tokens, roles, permissions, tenant isolation, and privileged actions.
---

# Authentication and Authorization

Check identity proofing, password or OAuth flows, session lifecycle, token storage, expiry, refresh, logout, CSRF, MFA, role checks, object-level authorization, tenant boundaries, admin paths, and account recovery. Verify authorization on the server for every sensitive operation.