ADR-001 · monorepo · Ratified
ADR-001: Clerk for Identity Authentication, PostgreSQL for Role Authority
Session tokens establish who the actor is; PostgreSQL profile records establish what the actor is permitted to do.
Context
Relying solely on third-party JWT custom claims for authorization creates a revocation window whenever a contractor’s license is suspended or an operator’s role changes.
Decision
Clerk handles authentication and session freshness only. Every protected route and Server Action resolves the actor’s authoritative role and capability set from PostgreSQL (User / AdminProfile).
Consequences
Immediate revocation across all edge and container workers upon database state change.