Proposed scope
Build a local identity lab to examine login flows, token handling, and access-control decisions. This is a proposed project; implementation and testing have not started.
Questions to investigate
Where are trust decisions made? How are token audience, issuer, and expiration checked? Can one user access another user’s resources?
Evidence to publish
A reproducible repository, architecture and trust-boundary diagrams, scoped test cases, and documented fixes with retest results. No findings are claimed at this stage.