feat(identity-access): add reusable business-scope assignments and segregation-of-duties policy hooks #746

Parent epic: #738
Depends on: #739
Related completed foundations: #681, #683, #696

Context

Current tenant-aware RBAC/ABAC/RLS correctly treats tenant as the isolation boundary. Enterprise and ERP-derived applications also need business-scoped authorization such as legal entity, branch, department, cost center, warehouse, project, or operational location. Those scopes must refine access inside a tenant without being confused with tenant isolation or hardcoding domain roles into the base.

A reusable segregation-of-duties (SoD) hook is also needed for combinations such as requester/approver, maker/checker, or posting/period-control, while leaving the actual domain rule definitions to owning modules.

Objective

Extend identity access with reusable, tenant-contained business-scope assignments, hierarchy resolution ports, effective/temporary validity, and module-contributed SoD conflict rules.

Scope

• Define a generic business-scope reference contract using scope_type + scope_id owned/resolved through capability ports rather than foreign keys to every optional module.
• Add tenant-scoped assignments connecting a subject/profile/user, role or permission context, and one or more business scopes.
• Support effective dates, temporary assignments, expiry, reason, grantor/approver, and revocation history.
• Define a hierarchy-resolution port so optional organization modules can resolve ancestors/descendants without identity-access directly importing their tables.
• Extend ABAC input with bounded business-scope facts while preserving default-deny semantics.
• Define a static SoD rule registry contributed by modules, including conflicting permission/role/capability combinations, scope applicability, severity, and approval/exception policy.
• Add conflict evaluation for assignment creation/change and high-risk authorization decisions.
• Add temporary exception/override flow only where explicitly allowed, with expiry, reason, approval, and audit.
• Add safe list/search endpoints and admin UI for assignments, expirations, conflicts, and review history.
• Add scheduled expiry/revalidation job through the shared worker runner.
• Add low-cardinality metrics for active/temporary assignments, expirations, denied cross-tenant scope, and SoD conflicts.

Security requirements

• Tenant remains the RLS/security boundary; a scope can never authorize access to another tenant.
• Unknown scope type, unresolved scope, stale hierarchy, expired assignment, and ambiguous conflict result default to deny for high-risk actions.
• Identity-access does not hardcode customer, supplier, accountant, cashier, mosque, merchant, or other domain roles.
• Scope identifiers are validated through the owning capability and cannot be trusted from request input alone.
• Temporary assignments and exceptions automatically expire and are audited.
• Self-grant/self-approval for high-risk assignment or SoD exception is denied.
• Read projections minimize PII and do not expose unrelated tenant subjects.

Out of scope

• Implementing legal-entity/organization-unit tables in identity-access.
• Replacing tenant RLS with business-scope filters.
• Implementing domain-specific finance, procurement, payroll, or approval rules in the base.

Acceptance criteria

• Generic scope assignments support effective dates, temporary expiry, revocation, and full audit history.
• Cross-tenant scope assignment and cross-tenant hierarchy resolution are rejected by RLS/ABAC negative tests.
• ABAC receives verified scope facts through a capability port and remains default-deny when resolution fails.
• At least three module-contributed SoD rule fixtures detect conflicts at global-within-tenant and scoped levels.
• Self-approval and unauthorized exception creation are denied.
• Temporary assignment/exception expires automatically and no longer authorizes access.
• Identity-access has no direct import/table write to an optional organization module.
• API list/search is paginated, filtered, permission-gated, and returns safe errors.
• Unit, PostgreSQL RLS, ABAC, hierarchy-port, expiry-worker, concurrency, and audit tests pass.
• OpenAPI/AsyncAPI if events are added, ERD/data dictionary, threat model, identity-access docs, admin guide, jobs/runbook, and changeset are updated.
• bun run security:readiness, bun run api:spec:check, bun run test, and bun run check pass.