Expand description
RBAC roles for the Team/Org plane (EPIC 13.2).
The team server already enforces fine-grained TeamScopes per token. Roles
are an ergonomic, governance-friendly layer on top: an admin assigns a
coarse role (viewer/member/admin/owner) instead of hand-picking
scopes. A role expands to a set of scopes, which the existing middleware
enforces unchanged — so RBAC is real and end-to-end with zero new
enforcement paths.
This is additive and Team/Cloud-only: it never affects the local plane.