Identity and access model

Checks

1. 1

   Session confirms user and expiry.

2. 2

   Membership links organization and workspace.

3. 3

   Role and group provide candidate permissions.

4. 4

   Scope limits resources.

5. 5

   Conflicts, plan, and feature state produce the result.

Diagnostics

Why-access and why-not tools should explain the policy chain without exposing another customer's data or sensitive policy internals.