Review shared visual patterns and component states.
Inspect cookie session claims, effective roles, and API authorization responses.