How does Firebase Authentication integrate together with Firestore security rules to properly control exactly which specific data a given authenticated user is actually allowed to access?

Once a user has successfully authenticated using Firebase Authentication, their unique user identifier automatically becomes available within Firestore security rules through the request.auth.uid expression, letting you write security rules that specifically compare that authenticated user's identifier against a corresponding field stored within a given document, such as ensuring a user can only ever read or write documents where a stored userId field genuinely matches their own specific authenticated identifier, tightly and reliably tying together who a user actually is with precisely what specific data they are genuinely allowed to access.

match /profiles/{userId} {
  allow read, write: if request.auth != null && request.auth.uid == userId;
}