Admin Row-Level Security Guard

High-complexity infrastructure component with no external service dependencies, but it is a hard prerequisite for any admin portal feature that touches protected data — meaning it must be delivered and reviewed early in the project timeline. Security-critical middleware requires thorough code review and penetration testing beyond standard QA; budget for a dedicated security review cycle before any admin features go to production. The super_admin bypass path must be explicitly tested to ensure it cannot be exploited by org_admin accounts. Changes to role claims or JWT structure downstream will require updates here, so maintain a clear contract between this guard and the authentication layer to minimise future rework.

Middleware service that intercepts admin data requests and enforces Supabase RLS by injecting org scope claims into the JWT context before queries execute. `buildScopedClient()` returns a Supabase client pre-configured with the admin's org scope claims, ensuring all subsequent queries on that client are automatically filtered by RLS policies. `assertOrgInScope()` performs an explicit guard check, throwing an authorisation error if the requested org ID falls outside the admin's permitted subtree (resolved via org-hierarchy-service). `isSuperAdmin()` enables the bypass path for cross-org queries.

Has no external service dependencies itself — it operates on claims passed from the auth layer. Must be integrated as a middleware or interceptor in every admin API route. Test with adversarial inputs: out-of-scope org IDs, missing claims, and forged super_admin flags.