What is the recommended pattern for implementing least-privilege UI rendering in Chakra UI when authentication state is managed externally?

Chakra UI Authentication Integration Challenge

Chakra UI is a component library focused on styling and layout; it does not include authentication primitives such as token storage, role-based checks, or automatic expiration handling. The library offers UI feedback components (Alert, Toast, Modal, Spinner) and hooks like useDisclosure that developers can use to surface auth-related states, but triggering them must be wired to external auth logic.

ChakraUIProvider and the theme context are unrelated to auth state; they only propagate styling tokens, so any least-privilege UI rendering must be derived from a separate auth context or state management solution. Because Chakra UI does not prescribe where auth tokens are kept, developers must decide on storage mechanisms (e.g., httpOnly cookies, memory) and implement token refresh logic independently, leaving the exact integration pattern as an open design decision.

Which approach best balances security and developer experience when building role-based interfaces with Chakra UI, and how should developers handle expired credentials without relying on client-side enforcement alone?