RBAC or role-based access control mentioned in overview

How to fix

1. Update the architecture overview with RBAC context.
2. Link to authorization docs or ADRs.
3. Mention the modules or services responsible for access-control decisions.

What the rule validates

The architecture overview is missing expected access-control context.

Why it matters

Access-control assumptions affect module boundaries, API behavior, and governance workflows.

Common causes

• RBAC was implemented after the overview was written.
• The overview uses product language without naming role-based access control.
• Security and authorization notes live in a separate doc that is not linked.

Typical violation example

The overview describes users and organizations but omits authorization boundaries.

Typical compliant example

The overview names RBAC and links the relevant auth modules and ADRs.

Related rules

Adjacent categories

Related files/config

• docs/architecture/overview.md
• docs/adrs

Related CLI commands

• archpilot validate
• archpilot validate --ci