Decide who can reach what — default-deny, on real identity — with every policy version tamper-evident.
Nothing is reachable unless a rule says so. An empty policy means teammates can reach nothing — you grant access deliberately, and you never have to remember to take it away.
A rule reads plainly: a who (a role and/or a tag) may reach a what (a service and/or a resource tag). A teammate's Services list is derived from these rules, so it can never drift out of sync with the policy.
You can only select on real identity attributes — role, tags, assurance level, owner, service, tier. You cannot base access on cosmetic things like a device's display name; the server rejects them outright. That keeps decisions auditable and closes accidental backdoors.
Every publish appends a new, hash-chained version of your policy. The app shows the version and chain intact ✓ — proof the history hasn't been altered.
For a team or a security reviewer, this is least-privilege you can prove: default-deny, decisions on real identity, and a tamper-evident history.