Auth, Security & Multi-Tenancy

Who is calling, what they may touch, and how to be sure: sessions versus tokens and what each costs, permissions that hold at the object level rather than the view level, the cookie and CORS rules that decide whether a browser will even send the credential, rate limiting, and keeping one tenant's data invisible to another.