LakeQL authenticates and authorizes every request before a query runs. The authorization model ties the pieces together; the concerns beneath it are JWT validation, permissions, scope authorization, and Trino user impersonation. Each has its own extension point, covered in the pages below.