Defaults
Hosted auth (Supabase, Clerk, or Cognito) unless you have a reason. Magic link or social for consumer. Passwords only if your users are in a corporate IdP conversation already.
Authorization
Every read and write checks who owns the row. We test the IDOR cases. “It worked in the demo” is not a test.
Fragen
SSO on day one?
If a design partner requires it, it is in the quote. Otherwise it waits. SAML is a calendar, not a toggle.