[Epic] Phase 1 — teams, security and governance

Parent

#132

Outcome

Evolve the current local admin/member model into secure multi-user administration with organizations, invitations, resource-scoped permissions, stronger authentication, automation identities, comprehensive audit, and deploy-time policy gates.

Security principles

• Deny by default at the service layer; UI visibility is never authorization.
• Human sessions and machine credentials have distinct lifecycles.
• Secrets are redacted at rest boundaries and in logs/events.
• Every mutating operation records actor, scope, target, request correlation, result, and sanitized diff.
• Recovery mechanisms are designed and tested before enforcement features ship.

Existing work incorporated

• #126

Children

• #142
• #143
• #144
• #145

Exit criteria

Teams can safely share a control plane across projects and services, auditors can reconstruct changes, and CI can use narrowly scoped revocable credentials without sharing a human account.

All child and incorporated governance work is complete. The final audit requirement landed in d99b56c; every mutating dashboard/API operation now produces a correlated, sanitized audit record. Closing this phase epic.