{
  "id": "api-rbac",
  "kind": "api",
  "summary": "Role-based access control — @voltro/plugin-rbac compiles a role→scope map and an interceptor resolves the caller's roles to scopes. Shows all three guard forms: declarative descriptor guards (statically checked by `voltro check`), resource-scoped guards (owner of THIS team), and in-handler permission()/can() for authz that needs the loaded row. Fails typed ScopeError; admin:full bypasses. Memory/config-only, zero infra; useCan() for web UI affordance.",
  "tags": ["api", "rbac", "authz", "roles", "permissions", "scopes", "guards", "plugin"]
}