Part 6 — Authorization at Scale: Access Levels, Roles, and Compact Decisions

Authentication answers "who are you?" Authorization answers the harder question: "are you allowed to do this?" By the time a request reaches this stage, we've already validated the token and confirmed the tenant. Now we need to decide — before the request touches any upstream service — whether this