Access

The per-tenant identity and authorization plane — the RBAC module covering principals, roles, grants, credentials, approvals, and audit within one company.

Access is routinely confused with Admin, and the distinction is the whole point: Access is per-tenant and belongs to the customer (a company's own admin manages their people and permissions inside it); Admin is cross-tenant and belongs to DOTS staff. A question about "who can do what in this workspace" is Access; a question about "which tenants exist" is Admin.

Authorization for other modules routes through Access rather than being mirrored locally — a package that needs a gate consumes the injected Access seam.

Usage examples

• "Access - the per-tenant identity + authorization plane (RBAC: principals, roles, grants, credentials, approvals, audit)."
• "Never add a KG-local auth mirror; authorization goes through @dots/access."
• "dots access is the RBAC family over the /access/* routes."

Source

AGENT-GOVERNANCE.md § Architecture (top-level modules, verbatim); the no-local-mirror rule at packages/knowledge-graph/AGENTS.md § Anti-patterns; spec row SPEC-129 (DS_Access).