Become somebody and rattle the gates. Your admin token mints
them a real end-user token (identity only, zero scopes) — everything they're
allowed to do comes from the role store. Change their role mid-session: the
token never changes, their powers do. That's the whole trick. 🪄
A heist played against the real authorization API. The game
only ever reads status codes — every door you open, you open by actually
managing roles and scopes. The other tabs aren't cheating; they're the toolbox.
🏴 THE VAULT HEIST
One role per person — picking a new one swaps it out.
Disable someone and they're locked out on their very next request, valid token or not.
A role is a named bag of permissions. Deny beats allow.
Click a scope chip to take it away.
Every permission this OS understands — generated from its own
route map, so it can't drift from what's actually enforced.
Who changed what, with before → after. The paper trail your
future self (and your auditor) will thank you for.
Every allow/deny at the gate, with the token reference (jti).
Green means in, red means computer says no.