Real Decision
Why permissions and billing entitlements were separated from business logic.
Problem
Traditional role-based permissions become difficult to maintain when features, plans and workspace capabilities evolve independently.
Decision
Built a capability layer that combines workspace membership, role and billing entitlements to determine whether a member can perform a specific action. This keeps authorization consistent and avoids duplicating permission checks across modules.
Why Not
Hard-code permission checks inside every domain service.
Bind product access directly to static role names.