Initial curated RAGcore source from c16667f0c9397e2bfc8dd0255b114fba23c8d05e

docs/02_DOMAIN/AUTHORIZATION_MODEL.md

@@ -0,0 +1,34 @@
+# Authorization Model
+
+## Principals
+
+- Human user via OIDC session.
+- Application service account via bearer token.
+- Internal worker identity.
+
+## Rollen
+
+`platform_admin`, `workspace_admin`, `space_manager`, `editor`, `viewer`, `auditor`.
+
+## Application scopes
+
+Voorbeelden: `search`, `context`, `answer`, `documents:read`, `citations:read`, `feedback:write`, `sources:sync`.
+
+## Effective-space algorithm
+
+```text
+effective = requested spaces
+          ∩ explicit grants for principal/application
+          ∩ active spaces in the same workspace
+          ∩ spaces compatible with operation and provider policy
+```
+
+Een lege requested set betekent alleen de configured defaults van de application, nooit alle grants. Filters worden door de server samengesteld en kunnen niet via raw Qdrantfilterinput worden overschreven.
+
+## Defence in depth
+
+- Use-case authorization vóór repository calls.
+- Workspace-gebonden databasequeries en waar passend PostgreSQL RLS.
+- Verplichte Qdrant payloadfilters.
+- Citation/documentread voert opnieuw resourceauthorization uit.
+- Securitytests proberen IDOR, filterinjectie, inactive records en cross-space leakage.