In my experience, you choose the key difficult parts first, and build a small toy version. From that action, you learn which parts of the interfaces are common, and may undergo modularization with a clean design pattern.
Ultimately with sanity checking, sanitized marshaling, and constraint programming... the underlying security model is naturally enforced within the pattern itself.
The deceptively simple systems are more like an ant colony or bee hive. =3
I nowadays vibecode entire apps to see what I want. Then I go build it
Sure, works if there is a statistically salient documented solution to glean in the LLM, or a de-compiled meta-circular generated clone. As long as one avoids the $9Tn of FOSS code other people wrote, than you should be fine.
Good luck with that. =3