# Actors and boundaries

## dashboard-operator

Browser user of `/decisions` and `/inbox`. No application role, user identity, ownership model, or RBAC schema exists in repository; collector proxy injects one server-held bearer token for every browser request.

- Actor surface: `apps/web/src/pages/decisions.astro:7`, `apps/web/src/components/inbox/InboxContent.tsx:26`
- Collector authorization: `collector/src/server.ts:20`
- Proxy token injection: `apps/web/src/pages/api/collector/[...path].ts:43`

No per-user authorization journey is authorable until product defines an identity and authorization boundary.