The authentication and security flow

You're finishing the Weather Dashboard app. You’ve built the frontend where users check forecasts, but now you need to secure it. To do this, you open Windsurf and define a new agentic workflow in YAML. What are the stages it should follow?