DL-505

Overlays get separate authenticatedOpen RPCs with a required TENANT|USER|ROLE layer, ROLE naming a taxonomy role; the default RPCs stay adminOnly.

Status: Active (Matt, 2026-10-13)

Record: ../../agent-config-overlays.md#decisions