It's a deliberate decision to not impose any set authn/authz structure on the user as many projects have differing requirements in that area.

Maybe someone could make a project creator on top of Phoenix that adds some basic authn/authz to the default structure.