How should OpenID Connect be designed for production?

For production, validate ID token signature, issuer, audience, nonce when applicable, expiration, and flow-specific requirements, while using access tokens separately for API authorization. Add automated tests and observability around the critical behavior, document ownership and failure handling, and review the design when traffic, dependencies, or security requirements change.