Providers authenticate; authorize handles custom Credentials verification; signIn allows or denies; jwt stores selected claims for JWT sessions; session exposes safe fields; useSession reads client session state; signIn and signOut initiate auth actions; and server-side checks protect data and operations. Keep identity verification, session state, UI behavior, and authorization separate.