Authentication
Access tokens, refresh tokens, account setup, and administrator MFA.
Authorization
Role checks, ownership checks, and server-side gallery access.
Threat model
Assets, actors, and the controls required for payments, galleries, and rewards.