A provider verifies identity; callbacks apply policy and shape token/session data; the browser receives a protected session cookie; UI hooks read safe session data; server checks authorize access.