(1) and (3), yes. (2) is not about process authentication but about using authenticated encryption that detects tampering.

More broadly, there needs to be a threat model that states what your attacker is capable of.

Even more broadly, I get the impression you’re not an experienced cryptography engineer and you didn’t work with one. Learning is great, but this is not presented with any warnings, which is irresponsible.