Users & roles

plan.md §10.2 RBAC matrix: see role permissions there.

What's real here

List, role-change, invite, deactivate/reactivate, and session list + revoke are all real, live against apps/api's identity module. Force 2FA reset is still shown as a disabled control, because no real TOTP/2FA system exists anywhere in this codebase, so there is nothing genuine to reset yet.

Filter by role

Loading…