Proving identity: sessions, tokens, MFA, recovery. Use when implementing login, token refresh, or auth bugs.
