# Senior auth & authz playbook

Compressed reference for the senior-only auth extension. Pair with [cheat-sheet.md](./cheat-sheet.md), [GLOSSARY.md](./GLOSSARY.md), and [repo-auth-map.md](./repo-auth-map.md).

## The senior shift
Intermediate understanding is: "I know what the JWT is, what Shamir does, what RBAC means, how permissions/locations work, and how RLS isolates tenants."

Senior understanding is: "I can explain the trust boundaries, failure modes, layering choices, and debugging order — and defend why the repo enforces identity and authority this way."

## Six senior lenses
1. **Token exchange is trust translation** — external authentication is not the same as internal authority.
2. **Verification is operational as well as cryptographic** — JWKS, issuer sets, rotation, and retries matter.
3. **Authorization is boundary design** — roles, permissions, location scope, and RLS each own different kinds of rules.
4. **Debugging starts with the chain** — token, claims, role gate, scoped permission, repo query, RLS.
5. **Internal calls still need identity** — service-to-service auth is still a trust-boundary problem.
6. **Guardrails matter** — scanners and fail-closed defaults exist because humans forget.

## Senior review checklist
- Can you explain what Shamir asserts beyond “it mints JWTs”?
- Can you name the real verification steps beyond “check the signature”?
- Can you explain why the repo blends RBAC, permission modeling, scoped locations, and RLS?
- Can you debug “login works, access fails” without jumping to the wrong layer?
- Can you explain why fake JWT context is not the same as no auth?
- Can you name the risk model behind service-to-service auth in this repo?

## Interview answer shapes
### Why token exchange?
Because the repo wants a first-party authority model. External identity proves who authenticated; Shamir translates that into internal claims like role, group, and tenant.

### Why not just roles?
Because roles are too coarse. Specific capabilities and location scope need finer modeling, while tenant isolation belongs in the database.

### Why use RLS too?
Because RLS shrinks the blast radius of app bugs by enforcing row visibility at the DB layer from trusted session context.

### Why is service-to-service auth still tricky?
Because an internal service can become a confused deputy if it acts with broader tenant scope than intended.

### What is the real debug order?
Check token verification, then claims/context, then RBAC, then permission/location resolution, then service ownership logic, then repo query shape, then RLS/session variables.