How do you implement authentication and authorization in custom software?

Authentication (who you are) and authorization (what you can do) require distinct implementations. Authentication: use established providers (Supabase Auth, Auth0, Clerk) rather than building custom auth. Implement email/password with bcrypt hashing (cost factor 12+), optional MFA via TOTP (Google Authenticator compatible), session management with HTTP-only secure cookies or JWT with refresh token rotation, and account recovery via time-limited tokens. Authorization: implement Role-Based Access Control (RBAC) for most applications, upgrade to Attribute-Based Access Control (ABAC) when rules depend on resource properties. RBAC implementation: define roles (admin, manager, user), assign permissions to roles (cancreateproject, canviewreports), check permissions at API endpoints and UI components. Database-level: use Row-Level Security (RLS) in PostgreSQL/Supabase for defense in depth, ensuring data access rules are enforced even if application code has bugs. Implementation patterns: middleware-based permission checks on API routes, React context for client-side auth state, protected route components for page-level access control, and field-level permissions for sensitive data columns. Security considerations: implement rate limiting on auth endpoints (prevent brute force), log all auth events for security monitoring, implement account lockout after failed attempts, use CSRF tokens for cookie-based sessions, and audit permission changes. Never store passwords in plain text, never log session tokens, and never trust client-side auth checks alone.