[amar-python]

Fixes #94. This is part 3 of ART Milestone 2 (BR-36; the roles come from ADR-0003).

The matrix (also in docs/ROLES.md)

Action	uploader	reviewer	tenant_admin	auditor
preview, upload	✓		✓
list files, read rows, list T&E tables	✓	✓	✓	✓
delete file			✓
read audit log			✓	✓

This is my recommended default and needs your sign-off. I picked it for three reasons:

• Only tenant admins can destroy data.
• Auditors are read-only but can see the audit trail.
• Reviewers stay read-only until approval and editing arrive (M4 and M6).

Changing it means editing one line in PERMISSIONS and the matching row in the doc. The test fails if the two disagree.

How

• PERMISSIONS in api/auth.py maps each action to the roles allowed to do it.
• allow(action) is a route dependency that returns 403 to any other signed-in role. It reuses the request's tenant_scope result, so the session is looked up only once.
• Requests without a session (shared API key, or dev) aren't role-checked. They keep today's access until the shared key is retired.
• Isolation tests (M2b: route every request to its tenant's schema (BR-36) #93) now use tenant admins. Cross-tenant isolation is checked at the highest privilege level.

Evidence

All runs are against local PostgreSQL 16.

Check	Result
Local replica of the CI integration job (scripts/test_report.py --strict)	281 passed, 0 failed, 0 skipped (277 on main + 4 new)
Evals p,i,s,e	26/26
tests/test_roles.py	4 passed: doc matches code; every role × every route (28 combinations)
Same tests with the role check disabled	all 9 refused combinations fail (as expected)
DB-free pytest	128 passed
scripts/lint.sh	clean

---

Generated by Claude Code

[amar-python]

Role matrix approved as proposed by the product owner on 26 Oct.

---

Generated by Claude Code