# Authorization Model

## Principals

- Human user via OIDC session.
- Application service account via bearer token.
- Internal worker identity.

## Rollen

`platform_admin`, `workspace_admin`, `space_manager`, `editor`, `viewer`, `auditor`.

## Application scopes

Voorbeelden: `search`, `context`, `answer`, `documents:read`, `citations:read`, `feedback:write`, `sources:sync`.

## Effective-space algorithm

```text
effective = requested spaces
          ∩ explicit grants for principal/application
          ∩ active spaces in the same workspace
          ∩ spaces compatible with operation and provider policy
```

Een lege requested set betekent alleen de configured defaults van de application, nooit alle grants. Filters worden door de server samengesteld en kunnen niet via raw Qdrantfilterinput worden overschreven.

## Defence in depth

- Use-case authorization vóór repository calls.
- Workspace-gebonden databasequeries en waar passend PostgreSQL RLS.
- Verplichte Qdrant payloadfilters.
- Citation/documentread voert opnieuw resourceauthorization uit.
- Securitytests proberen IDOR, filterinjectie, inactive records en cross-space leakage.