Compact role editing and restore tenant-scoped Team, Customers and SLA administration

[Proxicon]

Summary

Restore compact, tenant-scoped administration without broadening instance or identity authority.

Outcomes

1. Replace the repeated role-checkbox lists in Organizations → Members & access with compact member rows and one reusable role-assignment dialog; reuse it from tenant-scoped Team and eligible linked-customer access.
2. Make Roles & Permissions quieter: a neutral, small, non-interactive, content-width protected-built-in status chip; clearer row hierarchy and bounded summaries while retaining custom-role and assignment workflows.
3. Let Tenant Administrators use canonical Team (/admin/users), Customers (/admin/customers), and Tenant SLA Settings (/admin/tenant-sla-settings) for only the organizations for which they hold the relevant permission. Instance Administrators retain the global workflows.

Authorization and data boundaries

• Tenant.Users.Manage governs tenant membership management; existing roles-only access remains constrained to Tenant.Roles.Assign; local invitations require both permissions in the same organization.
• Add Tenant.Customers.Manage for tenant customer/contact management and Tenant.Sla.Manage for all four tenant SLA panels. Reconcile persisted built-in Tenant Administrator definitions idempotently; do not expand custom roles or the delegation ceiling.
• The API is authoritative. Query scope must be enforced before serialization/paging; writes authorize persisted resource ownership and reject forged tenant/owner/reference IDs.
• Do not expose global account lifecycle, credentials, provider administration, external synchronization, account deletion/disablement, relinking, or other-tenant membership operations through tenant workflows. Preserve provider grants, protected assignments, audits and invalidation behavior.

Implementation checklist

• Reusable MudBlazor role editor with independent draft state, filtering, loading/error states, target/tenant capture and safe save/cancel behavior.
• Compact searchable member panel and consistent fixed/authorized organization context.
• Restrained role table status/spacing/search/accessibility changes using component-scoped styling.
• Scoped Team, Customer and four-panel SLA API/UI flows, including direct URLs and navigation without duplicate trees.
• Permission catalog/effective-access projection/labels/docs/reconciliation updates.
• Security matrix tests for A/B/C tenants, split permissions, forged reads/writes, escalation, identity/provider safety, SLA ownership and fresh/upgraded role definitions.
• Component/UX coverage for dialog interaction, themes, responsive sizes and browser tenant-context transitions.

Acceptance matrix

Area	Required evidence
Navigation and routes	Authorized tenant users reach the three canonical routes only for authorized tenants; instance navigation stays complete and non-duplicated.
Scoped reads/writes	Lists, searches, lookup/count/status/detail payloads and all updates/deletes/creates exclude unauthorized tenant data and reject forged scope.
Permission pairing	Permissions are paired in the same organization; authority in A never combines with a different authority in B.
Role safety	Protected/provider/foreign/instance assignments cannot be escalated or overwritten; local editable assignments update safely.
Identity safety	Tenant actions cannot reset/delete/disable shared accounts, change login/provider links, or trigger forbidden provider operations.
SLA	Settings, calendars, policies and subscriptions remain tenant-owned; global defaults are read-only when legitimately visible.
Upgrade	Fresh and persisted Tenant Administrator definitions agree after reconciliation, without expanding custom/revoked roles.

Related: #52, #53 (prior administration work); #54, #55 (theme-first-paint regression boundary).

[Proxicon]

Implementation branch: fix/tenant-admin-ux-scoped-management

Draft PR: #57

Current implementation commit: 77b0e2a

Validation completed: release solution build; focused role/access and page-authorization tests (17 passing); dirty-file Slopwatch check. The draft PR records the remaining Customer/SLA workflow and broader validation work explicitly.