CAP-074 — Role-scoped API gateway

Category	Intelligence & automation (platform)
Business goal	BG-008
Satisfying module	MOD-044 JWT role-based access control
Mode	GATE
BD owner	BD09 Technology
Human needed	No

An API gateway that enforces role-based access control on every API call — agents can only access the data and operations their role is authorised for, regardless of which application they use to make the request. The JWT RBAC module issues role-scoped access tokens at authentication and validates them on every API request. A customer service agent cannot access compliance case data even if they know the API endpoint.