Security

Documentation in this directory covers access control and data protection for the CRM.

What belongs here

• Roles and permissions model
• Authorization rules (routes, RLS, page-level checks)
• Data privacy assumptions
• Audit logging
• Compliance considerations

What does not belong here

• Auth flow and middleware design → /docs/architecture
• Feature behavior → /docs/product
• Operational security (secrets, deployment) → /docs/operations

Index

See the files in this directory. Documents should reflect the current roles and policies; unverified content is marked with TODO.