Role-Based Access Control

RBAC is the gate that makes multi-tenant operation safe. Without it, a Coordinator from one organization could see another's activities, a Global Admin could silently read tenant data, and Org Admins could escalate themselves. Strict tenant isolation is a contractual requirement for organizations handling Bufdir-funded program data and sensitive personal information (epicrises, fødselsnummer). The audit-logged time-bounded support access flag is what lets pilot organizations accept Norse support involvement at all without violating their own data-protection commitments. Critical for MVP because every other feature relies on it for access decisions.

Authorization lives in the consuming products, not in the Authentication Module - the module only emits identity and a generic claims bag containing role and organization membership. Role-Guard middleware runs on every API endpoint in the Next.js backend and checks (role, organization_id, requested resource) against a policy table. Mobile clients use role claims to render the correct home dashboard and to surface Org Admins as Coordinators. The time-bounded Norse-support-access flag lives in organization_settings; expiry is enforced at request time, not just at session start. Every support session writes an entry to the org's audit_logs table.