Review steps
- Confirm auth.required and authentication.required are true when paid access is used.
- Check the bearer header format and token claim language.
- Reject vague access phrases that do not name a scheme or header.
- Record missing auth metadata as a launch blocker before distribution.