Separate authentication from projection
AuthOS spec declares identity and security-gated account behavior. AuthOS runtime converts those contracts into projections for RBAC, RoleMorph, personalization, redaction and other consumers. The README explicitly places authentication, database access and provider execution outside those pure projections. A concrete integration such as authos-better-auth and the product host perform that work. When adopting this area, trace where a verified session becomes a trusted subject before using an access projection in an API or interface.
Keep context request-scoped
The SSR entry binds the shared server-only subject scope with runWithSubject, cached reads and nested/concurrent request isolation. Subject construction stays with AuthOS; the lower propagation port does not decide policy. Subject providers can use a resolver and optional tenant-scoped cache, and malformed or failed resolution returns a denied/missing result. This separation helps prevent a convenient UI context from becoming an accidental cross-request authority source. Inspect cache keys and request lifetime alongside the subject shape.
Model provisioning as receipts and state
The provisioning reducer consumes redacted, idempotent receipts covering identity, entitlements, product-local membership, activation and revocation. It avoids activating a partially provisioned product and detects scope/idempotency conflicts. Rebuild and retry behavior therefore belongs to a recorded lifecycle rather than an unchecked sequence of provider calls. The domain-command helper can produce governance-bearing local events while retaining canExecute false plans. Host execution must still resolve the required provider, database and approval boundaries.
Follow a practical path.
Trace one authenticated request
Identify the identity provider, session verifier, subject factory, tenant/workspace selection and operation context. Keep user-supplied identifiers separate from the values the host has verified.
Inspect the missing-authority case
Follow an absent session, malformed subject, revoked membership or mismatched workspace through the same path. Check that both the UI projection and the execution boundary express the expected unavailable or denied state.
Review a provisioning retry
Use the existing receipt/reducer flow to see whether a repeated step resumes safely and whether partial activation stays visible. Bind the selected product membership and entitlement to the exact subject instead of treating organization membership as universal product access.