# Authentication and authorization security

* Use established authentication standards and password hashing; never store plaintext or reversibly encrypted passwords.
* Enforce authorization server-side for every sensitive operation and verify resource ownership and tenant boundaries.
* Use least-privilege roles, short-lived sessions or tokens where supported, and invalidate credentials after sensitive account changes.
* Validate token issuer, audience, signature, and expiry before trusting claims.
* Protect authentication and privileged actions against brute force and privilege escalation.
* Test unauthenticated, unauthorized, cross-user, and cross-tenant access paths.