# Core Organization Scope API

This increment activates company/branch-aware authorization.

## Scope headers
- `X-Tenant-ID`
- `X-Company-ID`
- `X-Branch-ID`

Headers select requested scope; they never grant access.

## Authorization
The permission evaluator now receives resolved company and branch IDs:
- tenant assignment applies across the tenant
- company assignment applies only to that company
- branch assignment applies only to that branch
- `DENY > ALLOW > ABSTAIN`

## Added APIs
- `GET/POST /api/v1/branches`
- `GET/POST /api/v1/warehouses`
- `GET/POST /api/v1/registers`
- `GET/POST /api/v1/devices`

Creation requires:
- branch -> company scope
- warehouse/register/device -> branch scope

## Audit events
- `core.branch.created`
- `core.warehouse.created`
- `core.register.created`
- `core.device.created`