A middleware chain can parse input, attach identity, enforce policy, log activity, transform responses, or handle errors. Ordering matters because each layer receives state produced by earlier layers. Critical authorization should fail closed when expected context is missing.