What does FastAPI OAuth2PasswordBearer do, and what security work is still required?

I centralize token validation in a dependency that returns a small authenticated-principal model, not the raw claims dictionary. It classifies missing credentials, invalid credentials, disabled accounts, and insufficient permission consistently without logging the token. Key rotation and identity-provider outages have explicit behavior, while resource checks use current application data when claims can become stale. OpenAPI security declarations and runtime enforcement are tested together because documentation alone does not protect a route.