Per OWASP MASVS v2 MASVS-AUTH: secure authentication and authorization in mobile apps. Requirements include (a) implement strong server-side authentication aligned to standards (OAuth 2.0 + OIDC + FIDO2/WebAuthn + biometric where appropriate) + (b) require multi-factor authentication for sensitive operations + (c) protect session tokens against theft + replay + with secure storage + handling + (d) implement client-side authorisation as defense in depth (do not rely on client for authorisation enforcement) + (e) implement biometric authentication using platform APIs with proper fallback + (f) implement secure credential lifecycle (storage + reset + revocation) + (g) implement step-up authentication for sensitive operations.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.