Nice concept! A missing area is identity management. Most likely this should be separated from your system (e.g. don't have a table somewhere with username, pa

Nice concept! A missing area is identity management. Most likely this should be separated from your system (e.g. don't have a table somewhere with username, password in it). In consumer facing systems, OpenID Connect (better) as practiced by Google, OAuth is used by most others. In enterprise software, SAML is the common parlance. That leads naturally to questions about API authorization (are API calls made on behalf of system users? If not, start probing further). Always enlightening to start asking questions about identity management very early on in designing systems.