Security design (security.md)

specs/design/security.md is where the PRD's Actors become enforceable access: one project-level document the openapi security schemes, the wireframes' per-role screens, and the coding agent's auth wiring all read. Every access rule cites the stories it serves, so security traces back to requirements like everything else.

Sections, in order