User Systems - full curriculum

Separate four things a product keeps confusing: who someone claims to be, how they prove it, how that proof is carried on every later request, and how they get back in when the proof is lost.

Move from 'is this person logged in' to 'may THIS person do THIS to THIS object' - and then to products where the object belongs to a team, and the team belongs to a customer.

Treat the user record as a state machine with real transitions, not a row you INSERT once and DELETE never - and learn what 'delete my account' actually has to touch.

Reject 'user created = onboarding complete'. Design for the moment the product first does something worth coming back for, and instrument the path to it.

A notification system is a distributed system: an event, a policy, a template, a channel, a queue, a provider and a delivery - each of which can fail on its own.

Everything that happens after something goes wrong: the internal control plane, the privileged access it grants, and the abuse it has to answer for.

Assemble the six modules into one architecture, then answer the question 2026 added: what authority may an AI agent exercise on behalf of this specific user, on this specific resource?