jobtrackingapp/docs/security/authorization.md

Authorization and tenancy

Tenant-owned records carry OwnerUserId directly or through a parent. JobTrackerContext applies global owner filters with deny-on-null semantics; services and background work use explicit owner checks when they bypass request-scoped filters. Admin users access user management, audit, and system readiness surfaces through Identity roles.

A browser route or hidden control is not an authorization boundary. Add server-side authorization and an ownership regression test for every new resource or endpoint.