feat(identity): enforce live scoped authorization and trusted evidence

feat(identity): enforce live scoped authorization and trusted evidenceHodeTech/LearnStack #39 · 3 diagrams

100%

01 / 05Live authorization replaces pass-through checksEvery protected request evaluates active memberships and role grants against committed database state. dispatches checks to , which verifies grants via .
02 / 05Refusal and mismatch evidence now capturedPolicy denials and header mismatches write immutable security audit records before returning to callers. captures refusals and writes records through .
03 / 05Dedicated read-only pools isolate checksIsolated connections prevent circular transaction deadlocks and enforce physical READ ONLY constraints. provides isolated read sessions to , defined in +54 −0.
04 / 05Administrative directory endpoint added to SDKClients can query tenant membership lists through a protected endpoint backed by cursor pagination. defines authenticated contracts for MembershipsController in frontend/packages/sdk/src/authenticated-contract.ts.
05 / 05Everything this change touchedLive scoped authorization, dedicated database pools, audit evidence, and the administrative directory.

esc to leave

StarHelp other teams find it