Authorization

Review SaaS API security with a synthetic matrix of tenants, roles, object ownership and actions. Keep token validation separate from server-side authorization, including list, export and background workflows.