Review feedback

[BraunMatthias]

No description provided.

[renejeglinsky]

No "(Inbound)" here?

[BraunMatthias]

I just wanted to add (Inbound) in this dedicated diagram to show once. I'd rather hesitate to use it in all titles (text or diagram) because it's common sense that "Inbound Authentication" = "Authentication".

[renejeglinsky]

All learn-more links are complete sentences that should have an ending, usually a dot.

[BraunMatthias]

done

[renejeglinsky]

Suggested change

	- [Authentication](./authentication )
	- [(Inbound) Authentication](./authentication )

[BraunMatthias]

see before

[renejeglinsky]

Those two points are missing if I'm not mistaken:

• Security Documentation Structure Updates: Add a prominent caution or danger box in the documentation explicitly warning developers not to perform security-related coding such as token creation or direct platform service handling, emphasizing strict decoupling from business logic. (Matthias)

• Authentication Strategy Guidance: Update the XSUAA section to include a clear info box stating to only use XSUA if IAS cannot be used, and otherwise always use IAS. (Matthias)

[BraunMatthias]

Those two points are missing if I'm not mistaken:

• Security Documentation Structure Updates: Add a prominent caution or danger box in the documentation explicitly warning developers not to perform security-related coding such as token creation or direct platform service handling, emphasizing strict decoupling from business logic. (Matthias)
• Authentication Strategy Guidance: Update the XSUAA section to include a clear info box stating to only use XSUA if IAS cannot be used, and otherwise always use IAS. (Matthias)

done