Ask the codebase, not the developers.

The admin API checks the user token, resolves workspace roles, and then applies route-level authorization before the handler runs.

1. Token validation happens in the shared auth middleware before requests reach the admin endpoints.
2. Role mapping is handled in the admin access layer that turns workspace membership into effective permissions.
3. Route checks still guard high-risk operations like billing and identity management.

The support role can authenticate successfully, but this route still requires the billing-admin permission set that support users do not have.

1. Auth succeeded so this is not a token or session problem.
2. 403 is expected because the route policy excludes the support role for this action.
3. Fix path is either use the correct admin role or move the action behind a lower-privilege endpoint.

Scheduled tasks are persisted, dispatched by the scheduler, and then routed back into the conversation channel that owns the task.

1. Persistence stores the task definition and next run timing.
2. Dispatch claims due tasks and executes them in the background worker flow.
3. Delivery posts the result back into the correct conversation thread.