What is a common mistake with authentication and authorization in Web API?

Repeating manual role checks throughout controllers creates inconsistent security. In practice, the value of this concept comes from understanding where it belongs in the architecture, what problem it solves, and what constraints or tradeoffs it introduces.