Security & Identity Layer (Cross-Cutting)
Policy-based access control