role-permission-validationlisted

# Role and Permission Validation ## Outcome Create a repeatable actor-by-resource-by-action permission matrix that verifies allowed behavior, denied behavior, direct navigation, and data isolation with durable evidence. ## When to use Use after browser and authentication setup when customers have multiple roles, workspaces, tenants, ownership rules, or privileged operations. Skip dimensions the application does not support. ## Discovery and user direction Inspect the current workflow, goals, metrics, configuration, capabilities, stores, reports, and triggers before proposing changes. Summarize reusable design and gaps, then ask focused questions for unresolved customer choices such as scope, success, approvals, thresholds, ownership, and budgets. Record the answers as customer direction. Installation alone does not approve workflow changes or execution. Default to one small-team workflow; split only for incompatible access or lifecycle boundaries. ## Required inputs Resolve authorized actors, role definitions, resource ownership states, allowed and denied actions, tenant boundaries, direct-URL expectations, safe test data, cleanup, and the approved source of permission truth. ## Plan and AgentWorks tools Use scripted steps for the stable matrix runner and deterministic completeness checks. Use message sequences to investigate mismatches without redefining policy. Partition credentials and fixtures when roles require different security contexts; branch only when clas