The 'Clean' way to handle Security and Auth.

Authentication is a 'Detail' (Adapter); Authorization is a 'Policy' (Domain/Use Case).

Checking who a user is (AuthN) happens at the edge (Passport, JWT middleware). Checking what they can do (AuthZ) often involves business rules. Authorization should be handled by passing the user's role/permissions into the Use Case, which then decides if the action is allowed.