Option D builds an evidence-based architectural map without indiscriminately loading hundreds of files. Authentication entry points may include route handlers, middleware registration, token-validation functions, session constructors, or identity-provider callbacks. After Grep identifies those anchors, targeted Read operations can establish their responsibilities, while imports, call sites, and configuration references reveal the downstream authorization flow. Anthropic’s large-codebase guidance recommends scoping Claude to the portion of a repository touched by the task because unrelated instructions and file reads consume tokens and degrade performance. Its common workflows guidance similarly recommends beginning broadly and narrowing into specific components. Option A launches agents before the relevant service boundaries are known and may produce overlapping, inconsistent investigations. Option B is an uncontrolled lexical sweep that will include tests, documentation, unrelated tokens, and incidental terminology. Option C appropriately checks project guidance but incorrectly delegates technical file selection to a new engineer who may not know the architecture. Incremental dependency tracing maintains context efficiency while producing a verifiable end-to-end map grounded in actual code paths.

================