Skill: backend/authz-policy

Purpose

Define and enforce authorization policy so protected actions are:

• explicitly allowed/denied by rule
• consistently enforced at boundaries
• tested (cannot regress silently)
• auditable when required

This skill is about authorization (authz), not authentication (authn).