Browser sessions use the same tenant, RBAC scopes, and request audit trail as API keys. OIDC and SAML resolve to one local user record — no parallel auth silo.