Broken Auth — playbook

The auth is always broken — you won't know until it's a lawsuit. The checks that catch it before your users do.