Capstone: an authorization decision that holds

Every request a production system accepts runs one gauntlet before anything else happens: is this caller allowed to do this, to this resource, right now? This capstone closes the P54–P56 Authentication & Identity arc by having you build that gauntlet whole — an RBAC role gate, a policy evaluation with explicit-deny precedence and wildcards, and a least-privilege guard, composed into a single decision. The hidden suite plays the attacker — privilege escalation, a missing-deny bypass, a wildcard over-reach, and an over-provisioned unused permission — and every attempt must come back denied.