auth-access-controllisted

# Principal-First Auth and Access Control Tie every protected effect to a verified **principal** and an explicit permission decision: `principal -> credential -> session/token -> permission model -> enforcement -> propagation -> revocation -> prove` Authentication proves who is acting. Authorization decides what that principal may do to this resource now. Keep the two contracts separate, and make deny the default whenever identity, tenant, scope, or context is missing or ambiguous. ## Choose the branch Run only the branch the request needs. Record missing evidence as a gap instead of broadening the task. - **Audit or diagnose:** trace real requests from credential to effect. Find the first link where identity is assumed instead of verified or a decision consumes client-controlled input, report it with its escalation path, and propose the smallest fix plus a runnable deny-path proof. Keep code and production unchanged. - **Design or plan:** define principals, credential and session/token lifecycles, the permission model, enforcement points, and revocation windows to the fidelity requested; label artifacts proposed. - **Build or fix:** change the smallest enforcement or lifecycle surface and prove it with a test that fails on the old behavior through the deny path, not only the allow path. - **Operate:** production key rotation, forced logout, credential or token revocation, and permission backfills require explicit authorization for the exact action and targets. Prefligh