Multi-tenant SSO. RBAC across superadmin / tenant-admin / manager / user. Live skill catalog, audit trail, billing reconciliation, connector health.
Pick a persona — each issues a JWT scoped to its RBAC role.
/api/v1/auth/mock-login issues an HS256 JWT cookie (HttpOnly, SameSite=Lax, Secure in prod). Swap to WorkOS OIDC by replacing the route — the JWT shape stays identical.