> Typically authorisation layers on top of existing data, but in this case, we had to redo data structure keeping auth in mind. Is that why you feel its brittle?

That's pretty much exactly it, I guess. It honestly just feels less "secure" than I'd like, even if it's not!