# IAM HTTP Authorization

## Purpose

This increment connects the proven RBAC evaluator to HTTP routes.

## Request pipeline

1. `auth:sanctum`
2. `ResolveTenant`
3. `EnsureTenantMembership`
4. `RequirePermission`
5. Controller
6. Application Action

The tenant header selects the requested tenant but never grants access by itself.

## Protected capabilities

- `GET /api/v1/companies`
  - requires `core.company.view`
- `POST /api/v1/companies`
  - requires `core.company.create`

`GET /api/v1/context` requires authentication and active tenant membership but
does not require an additional business permission.

## Decision rule

The middleware only proceeds on an explicit `ALLOW`.

- DENY -> 403
- ABSTAIN -> 403
- ALLOW -> request proceeds

This preserves the platform rule:

`DENY > ALLOW > ABSTAIN`

## Next IAM increment

- role administration API
- permission catalog API
- membership role assignment API
- company / branch scoped HTTP authorization
- audit events for authorization administration