Q: After rolling out Backstage with Okta OIDC authentication, developers complain that their sessions randomly expire while drafting templates, causing lost work. Additionally, junior developers can trigger production database deletion templates. How do you resolve OIDC token refresh and configure Backstage RBAC?

Configure Okta to grant `offline_access` scope and configure Backstage backend PostgreSQL session storage so token refreshes occur transparently in the background.

# app-config.yaml
auth:
  providers:
    okta:
      development:
        clientId: ${OKTA_CLIENT_ID}
        clientSecret: ${OKTA_CLIENT_SECRET}
        audience: ${OKTA_AUDIENCE}
        additionalScopes: ['offline_access', 'groups']

Implement a `PermissionPolicy` class in `packages/backend/src/plugins/permission.ts` inspecting the user's Okta groups to restrict sensitive templates.

class CustomPolicy implements PermissionPolicy {
  async handle(request: PolicyQuery, user?: BackstageIdentityResponse): Promise<PolicyDecision> {
    if (isTemplateAction(request)) {
      const isProdDbTemplate = request.attributes?.templateId === 'delete-prod-db';
      const isStaffOrLead = user?.identity.ownershipEntityRefs.includes('group:default/tech-leads');
      if (isProdDbTemplate && !isStaffOrLead) return { result: AuthorizeResult.DENY };
    }
    return { result: AuthorizeResult.ALLOW };
  }
}

Enable local storage draft persistence in the Backstage frontend so that form progress is never lost even if network connectivity blips.