However, in blockchain it's the combo of your private key to sign your wallet, along with the consensus engine where decentralized voting decides to accept the generation and association of new tokens.
In centralized servers, it's the combo of your credentials to login, along with the servers that update the database.
Once you own a token, you can create signatures for it that other peers can validate. For example
https://firebase.google.com/docs/auth/admin/create-custom-to...
I've already addressed your points about collateral and loans. That's purely business logic, and has nothing at all to do with NFTs (which are _only_ user<>token_id mappings)