The authorization endpoint: GET validates the request and shows the consent page (or redirects at once when consent is remembered); POST records the decision. Mount it inside the pipeline that requires a signed-in person; Sake reads the person through Sake.Auth.Subject.

After it resolves the resource (the endpoint URL the token is for), it asks the subject module's optional authorize_resource?/2 whether this person may authorize a client for it; a false answer sends the client access_denied. A remembered consent is kept per person, client and resource.

The consent form is protected in two layers. The hidden request field is a signed blob bound to the signed-in person, and it expires after ten minutes: a form posted by anyone else, or later, is refused. When the host's pipeline runs Plug.CSRFProtection (protect_from_forgery in Phoenix), the form also carries the CSRF token and the host's plug checks it. A Plug-only host without CSRF middleware sends an empty _csrf_token field and relies on the signed blob alone.

The consent and error pages refuse to be framed (x-frame-options: DENY and content-security-policy: frame-ancestors 'none').