# ADR 0029. Application-native authorization until a second service needs shared policy

## Status
Accepted (as listed in the decisions index).

Spec §17 allows OPA, Cerbos, or OpenFGA, and also allows ordinary
database-backed authorization initially. A policy engine now would duplicate
rules that already live next to Audience and integration checks in Nest.

## Decision

v1 authorization is application-native: Nest guards, authenticated
integration audience, and PlayerPal permission checks in the service that
owns the resource. IAM roles remain personas only (ADR 0011).

Revisit a policy engine when either is true: more than one service must
enforce the same PlayerPal permissions, or non-engineers must author those
rules without a deploy.

## Consequences

- [docs/authorization.md](../authorization.md) is the v1 rule list.
- Adding OpenFGA or Cerbos without the trigger above is a reopen of this ADR,
  not a default improvement.