Auth & RBAC

Every API request passes through a single authentication and authorization path. The server extracts credentials (API key or JWT), loads the associated roles, derives the requested action from the HTTP method and route, builds an IRN for the target resource, and evaluates policies. Authorization is two-layered: Layer 1 system RBAC (built-in roles + verbs) is authoritative for ALLOW; Layer 2 tenant-edit-time CEL is subtractive deny-only. See ADR 0015 and ADR 0016.

Layer 2 is not yet enforced at runtime. The active evaluator returned by rbac.Evaluator() is still the L1-only RBACEvaluator; LayeredEvaluator is installed only by tests, so tenant-authored CEL policies store, version and surface in the dashboard without changing live access decisions. The diagram shows the contract that wiring will enforce — see Authorization Policies (CEL) for the current status.