AuthNAuthZ

The core mechanisms: OAuth2 flows, session cookies vs JWTs, how authentication (who you are) differs from authorization (what you can do).

Why we need this / what value this brings

Conflating 'who are you' with 'what can you do' is a common source of access-control bugs — they need to be reasoned about separately.

AuthN is decided once (Clerk); AuthZ has to be decided per-feature as new resource types and roles are added.

Let Clerk issue identity (AuthN); write explicit permission checks (AuthZ) at the point where a resource is accessed, not just at the route level.

Clerk handles AuthN — where exactly does Localz's own AuthZ logic (provider vs customer permissions) plug in?

Empty folder — drop notes, links, and findings here as you research.