type: "fullstack" app. Per-user and AccountKit-gated: naive.auth or naive.forUser(id).auth. Admin operations use the service-role key (privileged) — disable the auth primitive in an Account Kit to keep agents away from end-user accounts. See the Auth guide.