Active scope
Enforced by the JWT claims your session carries (set by the access-token hook).
Agency (tenant)
Brand
Brands you can access
In the active agency, filtered by your role grants (RLS-backed).
Slice: auth · onboarding · tenant/brand switcher. Next: /account members + invites.