ADRs
ADR-0002: Centralize Auth + RBAC Policy Enforcement
Decision record for authorization architecture.
Context
Current route segmentation reflects personas, but final platform requires enforceable authorization across web, native, desktop, and TUI.
Decision
Use a central policy layer for authorization checks across route guards, API boundaries, and backend mutations.
Consequences
- Prevents policy drift between app surfaces
- Improves auditability and release safety
- Requires contract-driven policy definitions and shared role semantics
Alternatives Considered
- UI-only role checks
- Per-service ad hoc authorization
- Client-only enforcement