I don't believe actual users will login. The LLM through their harness will, using an identity and password found in some shared vault. The app will still do authentication but no user management. Behind an access token there might be zero, one or several humans. Dystopian version: The allow-list for the oauth redir will become the new gatekeeper in a world without local compte, and the redir client the billed entity.