Security checks are not enough if protected work can start before they run. Routes that call paid or sensitive external services need authorization before key reads, request processing, external calls, and mutations.

The surface problem

The simple version of the problem sounds familiar: add authen...