Problem#
An org directory is easy until roles matter: browse, edit, administer. One leaky admin flag is not access control.
What I built#
Full stack. Next.js, Express, Prisma, JWT with roles in the token. The directory, not a CMS theme.
One hard decision#
Put the role in the token and check it on every write. Convenience flags become the product later.
