# Smilegate Backoffice Identity Administration

## Goal

Keep `admin` as the backoffice control-plane login.  Provide an administrator-facing
model for managing Smilegate PoC tool users, groups, roles, and their assignments.
These users are tool operators (for example a Data & AI TF lead or member), not
game-service players.

## Scope

* `SG_APP_USER`, `SG_APP_GROUP`, and `SG_APP_ROLE` are the application masters.
* `SG_USER_ROLE`, `SG_USER_GROUP`, and `SG_GROUP_ROLE` express normalized
  user/group/role assignments.
* Every change is recorded in `SG_AUDIT_EVENT` by the backoffice audit service.
* Existing `/users`, `/groups`, and `/roles` pages use only the `SG_*` identity
  model.  They must not require the legacy VPD/permission objects to render.

## Seed data

| Type | Code | Purpose |
| --- | --- | --- |
| User | `sg-teamlead` | Data & AI TF team lead demo operator |
| User | `sg-member` | Data & AI TF member demo operator |
| Group | `DATA_AI_TF` | Smilegate Data & AI TF |
| Role | `DATA_AI_TEAM_LEAD` | Team lead operational role |
| Role | `DATA_AI_TEAM_MEMBER` | Team member operational role |

## Acceptance checks

1. An authenticated `admin` can open `/users`, `/groups`, and `/roles`.
2. The seed users, group, and roles appear; assignments can be added and removed.
3. Create, activation, role, and group changes are committed atomically and leave
   an `SG_AUDIT_EVENT` row.
4. The pages do not call the legacy effective VPD permission matrix.