One service. In front of your application. Gated by a real key instead of a password, and it never once touches your application's own code.
A door sits between a browser and whatever it's protecting -- a dashboard, a console, a file manager. It knows how to ask an identity authority one question, over and over: does this key holder belong here right now? Nothing about your application changes to make that true.
Re-checks the authority on every request. Serves a hash-verified sign-in page, so it can never silently serve one that was quietly edited underneath it. Runs on Python's standard library alone.
Modify your application's source. Hold a role or a policy table of its own. Start without an authority configured. Start with an unverified sign-in page. Start with RBAC quietly disabled.
Python 3. Nothing else. No pip install, no framework -- a door that can't start because a package failed to install is a door that's closed. The download includes the door itself, its sign-in page, and a README covering setup end to end. It does not include an identity authority -- you'll need one already running to point this at.
Requires a proven Cooren key. No key yet? Start at get.cooren.dev.