Identity and Access

Identity and Access Management — start here. The identity lifecycle, authentication against authorisation, and the vocabulary the rest of the cluster uses. The authentication and authorisation distinction is worth slowing down on: almost every access bug is one being mistaken for the other.

Role-Based Access Control — roles compose permissions, users are assigned roles. Read second, because it is the concrete model the abstract vocabulary above resolves to, and it is what the application layer actually consults.

Book Access and Permissions — the same model applied to the entity where it matters most. Useful as the worked example: the allowed-currency set that constrains what may be booked shows permissions doing real domain work rather than guarding a screen.

Service-to-Service Auth Patterns — what happens when one service must call another, and the choice between a service acting as itself and acting for the caller.

Internal Actor Impersonation — the pattern we use: a service self-mints a short-lived token impersonating a specific end user. Read it straight after the patterns note, because it is the one we chose from among them, and read both before touching any service-to-service call.

PostgreSQL Row-Level Security — the database mechanism, described before any project-specific use of it. Deliberately last: it is the backstop, and it is easier to see why the backstop is shaped as it is once the application-level model above is clear. An agent changing a query that crosses a tenant boundary should have read this page first.

User Journeys — everything above says what the system enforces. This one records what a person is trying to do, written from the goal rather than from the entity. Read it when the question is "what should this screen do" rather than "what does this entity hold". Each journey document also lists the operations and subjects its steps need, so the distance between the design and the server shows up as a table rather than as a surprise during the build.