I've started putting OIDC auth in front of my app (at the gateway level) so that no matter how badly my LLM botches the app, requests can't get through.

This only really works with 1-person apps though. If you need multiple users then you have to match the login with specific database records to make sure you're only exposing the right stuff.

I guess that is to say, even if your authentication is great, you can still botch the authorization.