# Authentication, User Management & RBAC

Milestone 21 is a frontend-only identity and access UI layer. It does not authenticate users, persist sessions, issue credentials, or enforce permissions on a server.

## Authentication screens

The `(auth)` route group contains sign-in, registration, password recovery, email verification, OTP, two-factor, magic-link, and social-login presentations. Submit handlers intentionally remain sample-only. Replace them with calls to your own identity provider or API.

## User administration

The dashboard includes user list, create/edit, details, activity, sessions, login history, devices, and masked API-key inventory. Existing typed Vexlora mock users are reused rather than duplicating the identity dataset.

## RBAC

Roles, permissions, a role/resource/action matrix, teams, and departments illustrate how a buyer can model access control. The checkbox matrix is presentation state only; real authorization must be enforced by the buyer's backend.

## Security boundary

Do not place OAuth client secrets, signing secrets, password hashes, API-key plaintext, database URLs, or session signing keys in this frontend template. Connect these screens to server-side authentication and authorization infrastructure in the buyer application.