Most applications treat identity as an implementation detail.

Authentication lives in the app. Authorization checks live in code.

Tokens move between services. It works, until systems grow and those

decisions spread across repos, services, and teams.

This is where identity quickly turns into a developer drag. Identity logic

stops being something you reason about centrally and starts becoming

something you discover by reading code. Changes take longer and

access rules drift before anything actually breaks.