Live
User Systems
Seven modules on the part of a product that knows who someone is. It starts with the four things a "user" quietly collapses - identity, credential, session and authorization - and takes each one seriously: how a password, a code and a passkey differ in what they can be stolen by, why a lifted session cookie walks past MFA and passkeys alike, and what OAuth actually delegates. Then permissions, from roles to relationships, through the access-control bug that sits in almost every generated CRUD layer, and out into teams, organizations and the three ways a SaaS keeps one customer's data away from another's. After that the parts nobody writes down: what the account lifecycle really has to touch when somebody asks to be deleted, why signup is not activation, and that a notification system is a distributed system with queues, retries and a provider that throttles. It ends on support and privileged access - letting somebody help a user without creating an invisible super-admin - and on the question 2026 added, which is what authority an AI agent may exercise on a user's behalf.
- Modules
- 7
- Lessons
- 34
- Watch time
- 28h 53m
- Free to open
- 7
Identity & Authentication
Separate four things a product keeps confusing: who someone claims to be, how they prove it, how that proof is carried on every later request, and how they get back in when the proof is lost.
- 01.01What a User Actually IsName the four separate things a 'user' collapses - identity, credential, session and authorization - and say which of them a database row actually holds.
- 01.02Passwords, OTP & Magic LinksChoose between password, emailed code and magic link for a given product, and state the attack each one is still open to.
- 01.03Passkeys & Phishing-Resistant AuthExplain why a passkey cannot be phished the way a password or an OTP can, and what changes in your data model when you store one.
- 01.04Sessions, Cookies & Stolen TokensTrace what a browser sends on the request AFTER login, and explain why a stolen session cookie defeats MFA and passkeys alike.
- 01.05OAuth & OpenID ConnectSay what OAuth delegates and what OIDC adds on top of it, and name the flow RFC 9700 tells you to use and the two it tells you to stop using.
- 01.06Verification & Account RecoveryDesign a password reset and account recovery path that does not become the weakest way into the account.
Permissions & Organizations
Move from 'is this person logged in' to 'may THIS person do THIS to THIS object' - and then to products where the object belongs to a team, and the team belongs to a customer.
- 02.01Authentication Is Not AuthorizationPlace RBAC, ABAC and ReBAC on one axis and pick the simplest of the three that can express your product's rules.
- 02.02The IDOR in Your APIFind the endpoints in your own codebase that fetch an object by id without checking who owns it, and say why a generated CRUD layer produces this by default.
- 02.03Fine-Grained Authorization & ReBACModel a Drive-style sharing rule as relationships rather than roles, and say what a Zanzibar-derived system buys you over a permissions column.
- 02.04Teams, Organizations & Multi-TenancyChoose between silo, pool and bridge tenant isolation for a SaaS product, and name what leaks first when you get it wrong.
- 02.05Invitations, SCIM & Enterprise LifecycleExplain why an enterprise customer will not accept 'invite your colleagues by email', and what SSO plus SCIM actually provision and deprovision.
User Data & Lifecycle
Treat the user record as a state machine with real transitions, not a row you INSERT once and DELETE never - and learn what 'delete my account' actually has to touch.
- 03.01Profiles, Preferences & User DataSplit the user record into identity, profile and preference data, and say why the three have different durability and privacy rules.
- 03.02The User Lifecycle State MachineDraw the states a user moves through - anonymous, registered, verified, active, dormant, suspended, deleted - and name what each transition must do to sessions and grants.
- 03.03Account Changes, Merging & RecoveryHandle an email change, a duplicate account and a merge without losing ownership of the objects the old identity created.
- 03.04Privacy, Data Export & DeletionEnumerate everywhere one user's data lives - primary tables, derived tables, caches, logs, analytics, backups - and say which of those a deletion request can and cannot reach.
Onboarding & Activation
Reject 'user created = onboarding complete'. Design for the moment the product first does something worth coming back for, and instrument the path to it.
- 04.01Signup Is Not ActivationDefine your product's activation event as one observable action, and explain why signup conversion can rise while activation falls.
- 04.02Designing the First-Value JourneyMap the shortest path from a new account to first value, and cut every setup step that does not sit on it.
- 04.03Progressive Onboarding & InvitationsDecide what to ask for at signup and what to defer, and handle the case where the second user arrives by invitation rather than by signup.
- 04.04Activation States & Re-engagementStore activation as state on the user rather than recomputing it, and trigger re-engagement from that state without spamming.
Communication & Notifications
A notification system is a distributed system: an event, a policy, a template, a channel, a queue, a provider and a delivery - each of which can fail on its own.
- 05.01The Notification SystemDraw the pipeline from a domain event to a delivered notification, and name the component that owns each decision along it.
- 05.02Email, Push & In-AppPick a channel per message type by what the channel guarantees, not by what is easiest to send.
- 05.03Preferences, Frequency & StateStore notification preference as first-class user state, and implement digesting and quiet hours without losing a message.
- 05.04Delivery, Retries & Provider FailuresHandle a throttling provider without amplifying the spike, and say why a naive retry makes an outage worse.
- 05.05Transactional vs MarketingSeparate the two mail streams by domain, provider and consent, and explain why mixing them can take your password resets down.
Support, Admin & Trust
Everything that happens after something goes wrong: the internal control plane, the privileged access it grants, and the abuse it has to answer for.
- 06.01Building Support Into the ProductDesign support as a product surface with the context attached, rather than as an inbox somebody else reads.
- 06.02Admin Panels & User OperationsSpecify the internal control plane a support person needs - find a user, read their state, change one thing - and keep it out of the product's own auth path.
- 06.03Impersonation, Audit Logs & Privileged AccessLet support see what a user sees without creating an invisible super-admin, and make every privileged action attributable after the fact.
- 06.04Abuse, Moderation & Account SafetyTreat abuse as a systems problem - rate limits, reporting, suspension, appeal - and say what each control costs a legitimate user.
- 06.05AI Support Agents & Human HandoffGive an AI support agent a bounded set of actions and a confidence threshold at which it must hand the conversation to a person.
Building the User System
Assemble the six modules into one architecture, then answer the question 2026 added: what authority may an AI agent exercise on behalf of this specific user, on this specific resource?
- 07.01The Architecture of a User SystemLay out identity, authorization, profile, notification and support as separate components with named boundaries, and say which of them you should not build yourself.
- 07.02When the User System BreaksDegrade gracefully when the identity provider, the mail provider or the authorization service is down, instead of logging everybody out.
- 07.03Security Boundaries & Failure ModesLocate every place your system decides 'may this actor do this', and confirm the decision is made on the server, on every path.
- 07.04Agents Acting on Behalf of UsersGive an AI agent an identity of its own and a delegated, scoped authority, so that 'the agent did it' and 'the user did it' are different facts in the log.
- 07.05Directing & Auditing an Agent That Builds AuthSpecify a user system to a coding agent precisely enough to be built, then review what it wrote for the four failures this course names.