Security boundary

Authentication is necessary but not sufficient. Every protected resource also checks internal user kind, account membership, role, and object scope.