inc/auth.php manages sessions and login—classic PHP patterns; harden TLS and session cookies in production.
Role and object permissions typically enforced in PHP layer—review upstream for RBAC depth.
Suitable for internal teams; enterprise SSO may require custom integration unlike Source A’s OAuth/SSO modules.