Build end-to-end authorisation coverage rail

Is your feature request related to a problem? Please describe.

Bodyguard policies are generally solid and tested, but authorisation coverage is not systematic. Authorization logic is tested, but coverage is not enforced across the full request surface. Furthermore, new routes/LiveViews can be added without explicit tenancy expectations, and policy correctness alone does not guarantee entry points are wired to required auth/tenancy guards.

Tell us about your idea - describe the solution you'd like.

Authorisation Harness
Create a CI-enforced, table-driven authorisation harness that proves every protected surface has explicit expected behavior and that required guard checks are actually in effect.

• Policy matrix coverage:

  • role/persona × action expected outcomes
  • omission failures for missing roles/actions

• Route/LiveView surface coverage:

  • every protected route/LiveView/action mapped in matrix
  • omission failures when new protected surfaces are added without entries

• Guard/rail verification:

  • verify each protected surface is wired through required auth + tenancy guards/hooks/
    plugs

Tests should fail when:

1. protected route/LiveView/action has no matrix entry,
2. role/persona coverage is incomplete,
3. guard wiring is missing/mismatched for a protected surface,
4. wrong project/non-member behaviour differs from expected outcome.

Success Criteria

• CI fails if a new protected route/LiveView/action is added without matrix coverage.
• CI fails if role enums change and matrix entries are incomplete.
• CI fails on wrong-project leakage regressions.
• Matrix tests are table-driven and easy to extend for new features.

No files, tests, or entry points are named. Start by inventorying protected routes, LiveViews, actions, role/persona definitions, and the required auth and tenancy guards, hooks, or plugs. Done means CI detects missing matrix entries, incomplete role coverage, missing guard wiring, and wrong-project or non-member behavior regressions.