How do you separate security responsibilities between a frontend client, an ASP.NET Core API, and an identity provider?

In production I document the trust boundary and credential flow. Browser-held bearer tokens increase the impact of script injection, while cookie-based sessions require CSRF defenses; a backend-for-frontend can reduce browser token exposure but adds operational complexity. Claims can become stale, so sensitive decisions may require current server-side state or short token lifetimes rather than packing every permission into a token. Authorization failures expose minimal detail, and some resource lookups return not found when revealing existence would leak information. Tests cover anonymous, allowed, forbidden, disabled-account, changed-permission, and cross-tenant requests at both endpoint and data-query boundaries. Audit records capture meaningful security decisions without storing raw tokens or creating a record for every harmless read.