Where SurrealDB authorization lives

Layer	Decides	During and after the port
persons.role	The tier: owner, admin, lawyer, clerk, client	Unchanged — the sole tier answer
person_project_roles.participation	Per-matter scope	Unchanged — the sole scope answer
Embedded Rego	Renders the decision per request	Compiled at web-process boot
Surreal PERMISSIONS	Per-row engine enforcement	Explicit NONE; every process signs in as root