0002: Auth owns access decisions

• Status: Accepted
• Date: 2026-09-07
• Decision maker: Trevor Gerhardt

Context

Protected pages and queries need access decisions that remain safe when callers use them independently. The proxy cannot supply a trusted actor to those queries.

Decision

Auth owns identity, sessions, organization access, and system-administrator access. Services owns Project and Application permissions built on Auth's identity and stored roles. Application adapters turn safe refusals into navigation and HTTP responses.

The proxy checks only for a session cookie. Each protected read checks authoritative access before returning data. The app can reuse a read within one render, but it does not cache an access decision across requests. Commands apply their own freshness and authorization rules under ADR 0010.

Consequences

• A streamed denial screen does not guarantee an HTML error status. API error statuses remain explicit.
• A later request sees changed membership or role data. An accepted command can finish after revocation under its command-start decision.
• Auth does not own Project or Application operations.

History

The proxy once checked access before streaming. The application now owns render-local reuse, while each protected query keeps its own access check.