RBA client portal
Secure Portal Foundation
Phase 3 adds the portal-side auth, IAM, membership, role, and protected-route boundary while keeping production OAuth, FastAPI sessions, storage, billing, and analytics logic out of scope.
Client workspace
A client-facing shell for intake, uploads, reports, dashboards, action items, billing links, and settings.
Client routes now require a client membership and route-level permission.
Open client portalAdmin workspace
An internal shell for organization, project, intake, upload, run, report, dashboard, finding, action-item, and audit workflows.
Admin routes now require an internal RBA role and admin permission.
Open admin portalPhase discipline
The shell preserves the boundary between the portal, the public website, and the separate sprint engine.
Auth boundary
Typed sessions, roles, permissions, and route guards are in place.
Mock local mode
Development personas are local-only and fail closed outside development.
No private files
R2 upload, signed access, and audit events are deferred.
No analytics engine
Python, SQLMesh, DuckDB, DuckLake, and job execution remain separate.