Macaw.Auth.Ash's configuration, read from the application environment and checked, so a fault names its key rather than failing a sign-in somewhere deeper:

config :macaw_auth, Macaw.Auth.Ash,
  user_resource: MyApp.Accounts.User,
  token_resource: MyApp.Accounts.Token,   # default: the user resource's
  domain: MyApp.Accounts,                 # default: the user resource's
  strategies: [:password, :nas],          # or strategy: :password
  roles_from: :roles,                     # or {MyApp.Accounts, :roles_of}
  username_field: :email,                 # default: the first strategy's identity field
  display_name_field: :name,              # optional
  source_field: :source,                  # optional; without it every user is "local"
  disabled_field: :disabled_at,           # optional, boolean or timestamp
  idle_days: 14

• strategies are AshAuthentication strategy names on the user resource, tried in order as Macaw.Auth.Native's sources are: the first that knows the user decides (Macaw.Auth.Ash.authenticate/2). Each is a password strategy or a Macaw.Auth.Ash.Strategy.Ldap.
• roles_from is an attribute holding a list of strings, or {m, f} called with the user record.
• idle_days: a session unused this long expires; 1 to 3650, as the native backend's session_idle_days. The user resource's token_lifetime must be at least this long: the JWT's expiry is a session's absolute limit (Macaw.Auth.Ash.Sessions), so a shorter lifetime would end sessions before they are idle. It is checked here, not left to a host to notice.

Two of the resources' own faults are refused here too, though a compile warning names them first (Spark reports a verifier's error as a warning, so they compile unless warnings are errors): a token resource without Macaw.Auth.Ash.Notifier, and an LDAP strategy on the user resource, named in strategies or not, whose field option isn't an attribute.

Read on every call (get/0), not cached: it is a handful of keyword lookups, and a test or a host that changes it sees the change at once. A fault raises ArgumentError: it is a deployment bug, not a refusal.