# IAM Governance

This increment completes the first IAM governance layer.

## Added operations

- update tenant roles
- replace role permission effects
- suspend/reactivate tenant memberships
- revoke role assignments
- audit all sensitive IAM mutations

## Current security chain

Authentication
-> Tenant Resolution
-> Active Membership
-> Permission Evaluation
-> IAM Administration Action
-> Audit Event

## Governance rules

- system roles are not editable through the standard tenant role update path
- membership status is explicit (`active` or `suspended`)
- suspended memberships are denied by tenant access middleware
- role assignment revocation is audited
- role permission replacement is transactional
- unknown permission codes are rejected
- all IAM mutation targets must belong to the active tenant

## Next architectural step

The IAM foundation is now sufficient to begin expanding Core business APIs.
The next increment should focus on Company / Branch / Warehouse / Register /
Device administration and enforce scope-aware permissions on those resources.