CAPABILITY MAP: IDENTITY & ACCESS
════════════════════════════════════════════════════════════

  CAPABILITY                         MATURITY     GAP?
  ──────────────────────────────     ────────     ────
  Authentication (Clerk)             ████░ (4)
  Identity Resolution (Adapter)      ████░ (4)
  Multi-Tenancy Schema               ████░ (4)
  Auto-Provisioning                  ███░░ (3)
  Org ID Propagation                 ███░░ (3)
  Audit Trail Schema                 ██░░░ (2)
  Billing Schema                     █░░░░ (1)
  Authorization (PolicyEngine)       █░░░░ (1)    CRITICAL
  Redirect Error Handling            ░░░░░ (0)    CRITICAL
  Role Seeding                       ░░░░░ (0)    CRITICAL
  Admin Bootstrap                    ░░░░░ (0)    CRITICAL
  Invite Flow                        ░░░░░ (0)    GAP
  Org Switching                      ░░░░░ (0)    GAP
  Security Testing                   ░░░░░ (0)    GAP

════════════════════════════════════════════════════════════

Browser → Clerk Middleware → Session Valid?
  ├── NO  → /sign-in (public route)
  └── YES → ClerkAuthAdapter.validateContext()
              ├── Clerk userId present?
              │     ├── NO  → INVALID_SESSION error
              │     └── YES → Lookup in org_system_user
              │                 ├── FOUND → Return ApplicationContext
              │                 └── NOT FOUND → Auto-provision
              │                                  ├── Create org_system_user
              │                                  ├── Create "Personal Workspace" org
              │                                  ├── Assign Admin role (bootstrap) ← MISSING
              │                                  └── Return ApplicationContext
              └── Error → LOOKUP_FAILED / PROVISION_FAILED

Server Action called
  → buildService() → authAdapter.validateContext()
    → Returns ApplicationContext { userId, systemUserId, organizationId }
      → governance.policyEngine.canI(context, action, resourceType)
        ├── defaultAllow: true  → ALLOW (current state — bypass)
        └── defaultAllow: false → Check governance_role_permissions
              ├── Permission found → ALLOW
              └── Permission not found → DENY → 403

Clerk User (external)
  └── org_system_user (internal, branded SystemUserId)
        └── org_organisation (tenant boundary)
              ├── All business data scoped here
              ├── governance_user_roles (what can this user do in this org?)
              └── governance_permissions (what actions exist?)

One user can belong to multiple orgs (composite unique: external_auth_id + organisation_id)

Request arrives
  → Clerk Middleware (validates session cookie)
    → ClerkAuthAdapter.validateContext()
      → Resolves: externalAuthId → systemUserId → organisationId
        → Returns ApplicationContext { systemUserId, organisationId, ... }
          → buildService(context)
            → Every repository method receives organisationId
              → Every SQL query includes WHERE organisation_id = $1
                → Response scoped to tenant