Why do Node.js auth decisions create long-term governance risk?

Because the auth layer sits at the trust boundary and tends to become deeply embedded in application logic. When it lacks lifecycle support, teams add custom code for onboarding, offboarding, and access changes. That custom layer is usually harder to audit, test, and maintain than the original application feature.