Imagine you're building several applications – a web app, a mobile app, and perhaps a backend service. Each of these needs to know who its users are and what they're allowed to do