Single sign-on
What this covers
Directory sync
Linking Teams to identity provider groups (adrs/0009.md).
Agent policies
What each Team's agents may do.
Data access
RBAC in Django: who may see which tables, columns, and rows. Session authentication and org