Where should authentication and authorization happen in an App Router application?

I model tenant and resource authorization, not just global roles, and ensure every query is scoped by trusted identity before it can return rows. Cache entries containing user data are request-safe and never keyed only by a public URL. Proxy matchers avoid assets and unnecessary expensive work, while secure checks remain correct if Proxy is bypassed. Tests call pages, actions, and handlers directly with missing, expired, forged, cross-tenant, and downgraded sessions, then verify both response behavior and absence of leaked data.