A Policy Per Endpoint: How Declarative Security Compiles
Permissions(), Claims() and Scopes() in Configure() feel like magic until you read the mapping code - every endpoint gets its own named authorization policy built from closures at startup, and roles ride a plain AuthorizeAttribute. Part 7 of FastEndpoints in Depth.