| Multi-client tenancy | Every data-bearing row is scoped to a clientId. One deployment serves multiple retail clients (for example Boxer, Clicks). |
| Session-based auth | better-auth stores sessions in the database. No JWT tokens. Cookie-based, SameSite=None; Secure in production for the cross-origin deployment. |
| Capability-based authorization | Routes declare required permissions via @Permissions(...). PermissionsGuard resolves roles to a permission set. |
| Store-scoped access | ScopeGuard ensures a Store Manager can only access their own store’s data. HR can access any store within their client. |
| Entitlement-driven ordering | Orders are validated against the employee’s rule set and remaining balance at submission time. |
| Zero self-registration | Portal accounts are created by Muze Admin only. Self-sign-up is disabled in better-auth. |
