The access overview (BOU-854): groups by modules, each cell the level a
group holds there, with Everyone and the superusers first, as they reach
furthest.

Pure functions for creating audit log entries.

This namespace contains CORE (pure) functions for audit trail management.
In FC/IS architecture, this is the CORE that:
- Contains pure business logic for audit entry creation
- No side effects - returns data structures only
- All I/O is delegated to shell layer (persistence)

Key FC/IS principles:
- Pure functions only - deterministic, no side effects
- Returns data that shell layer will persist
- Business rules for what gets audited and how

Functional Core - Pure authentication business logic.

This namespace contains ONLY pure functions for authentication:
- Credential validation logic
- Authentication decision making
- Login attempt analysis
- Account lockout logic

All functions are pure and deterministic - no I/O operations.
Password hashing and token operations are handled in the shell layer.

What moving an app from `:wagoe/authorization :off` to `:enforce` changes
for its users, as data and as text for `wagoe upgrade authorization`.

Under `:off` every signed-in user passes every route, and the admin admits
role `:admin`. A finding is a user, endpoint and permission where
`:enforce` decides differently. A user here is {:id :email :role :tenant-id
:platform-admin? :rights}, `:rights` resolved as the interceptor reads them.

What the user module puts in a user's data export (GDPR Art. 20).

Giving a user one permission, and nothing more, through groups (BOU-853):
rights are never granted to a user directly. Options are ranked by what
else they give, read from their previews (`IRightsPreview`).

The grant wizard (BOU-853): give a user one permission through a group,
each option with its preview, the one giving least else first. Pure
Hiccup; each option's form posts to the page that makes that change.

The rights a user holds through their groups, and whether a role or an
assignment may be made (ADR-041 §2–3).

An assignment is a group, a role and a scope. A user's grants are the
permissions of the roles assigned to their groups, each
{:permission kw :scope map} plus where it came from (:group-id :group-name
:role). `holds?` and `grants-for` answer for the permission, and the
application judges the scope.

Admin pages for groups, their members and their roles. Pure Hiccup; plain
forms that post and redirect.

Authorization hygiene signals (BOU-855): what the groups, roles and
permissions lists badge and filter on. Each item gets `:signals`, a set of
keywords. Assignments as `all-assignments` gives them.

Where a user lands after signing in.

Functional Core - Pure MFA business logic.

This namespace contains ONLY pure functions for MFA:
- MFA decision logic (when to require MFA)
- Backup code validation logic
- MFA setup preparation
- MFA status evaluation

All functions are pure and deterministic - no I/O operations.
TOTP generation and cryptographic operations are handled in the shell layer.

OpenID Connect sign-in decisions: provider config, the authorization URL,
state and id-token claim checks, and which account a sign-in belongs to.

Pure. Fetching documents, verifying signatures and writing sessions is
wagoe.user.shell.oidc. Failures are values: {:error {:type … :message …}}.

The one reading of a configured password policy.

Two validators used to read the same policy under two spellings —
`validate-password-constraint` wanted `:require-numbers?`, which is what
`config.edn` writes, and `meets-password-policy?` wanted `:require-numbers`,
which nothing writes. Configuration reached one of them and not the other,
so registration rejected passwords on rules the config had switched off
(BOU-388).

`?`-suffixed is canonical. The unsuffixed spelling is still read, so a
caller passing a hand-built policy keeps working.

Profile-specific UI components for user profile management.

This namespace contains pure functions for generating profile-related Hiccup
structures including profile viewing, editing, password changes, and MFA setup.

Admin pages answering who may do what (ADR-041 §7): roles, permissions and
a user's rights. Pure Hiccup in the admin shell; plain forms that post and
redirect.

Functional Core - Pure session business logic - Minimal working version

User-specific UI components based on User schema.

This namespace contains pure functions for generating user-related Hiccup
structures. Components are derived from the User schema and handle
user-specific business logic for display and forms.

Functional Core - Pure user business logic.

This namespace contains ONLY pure functions with no side effects:
- No I/O operations (no database calls, no logging, no HTTP)
- No external dependencies (time, random generation, etc.)
- Deterministic behavior (same input always produces same output)
- Immutable data structures only

All business rules and domain logic for users belong here.
The shell layer orchestrates I/O and calls these pure functions.

Enhanced domain validation functions for user business rules.

This namespace contains comprehensive validation functions that implement
business rules beyond basic schema validation. All functions are pure
and follow FC/IS architectural principles.