What do security teams get wrong when they assemble authentication from multiple libraries?

They often underestimate the amount of custom work needed for user management, password reset, token refresh, audit logging, and revocation. That creates a brittle stack where security outcomes depend on integration quality rather than on a coherent control model.