Short-lived tokens, refresh rotation and device revocation.
Coarse roles plus fine-grained scopes, evaluated in one place.
OIDC and SAML with per-tenant configuration.

the primitives land. It is why sessions and tokens is a first-class concern and not a README footnote.

retries and replay. It is why roles and scopes is a first-class concern and not a README footnote.

no shared tenancy required. It is why sso ready is a first-class concern and not a README footnote.

stable interfaces. It is why audit log is a first-class concern and not a README footnote.