Threat boundaries

The following invariants define the integration boundary:

• Tenant isolation: clients, subjects, grants and signing keys belong to one issuer.
• Exact identity: product bindings use exact (issuer, subject), never email alone.
• Audience isolation: an access token is accepted only by its intended resource.
• Explicit federation: cross-tenant authentication requires configured directional trust and account linkage.
• PKCE: public and browser clients bind a one-use code to the initiating instance.
• Server-side authorization: UI visibility never replaces scope and live-permission checks.
• Write-only secrets: newly issued secrets are displayed once and cannot be read back.
• Trusted proxy: only the deployment edge may supply forwarded scheme and host information used to reconstruct the public issuer.

When a product needs a new authentication behavior, add it at the Identity boundary and preserve these invariants instead of creating a local password or MFA path in the product backend.