---
path: /studio/yemaya/auth
surface: studio
domain: yemaya
auth: signed-in + studio entitlement (AAA-gated for write paths)
source: apps/oshun/web/src/app/studio/yemaya/auth/page.tsx
status: walked
last_walked:
  '2026-05-29 automated runtime walk (Playwright headless) — render, /v1 data
  (2xx), console/page-errors, expected content, screenshot verified; live
  screen-reader, touch, offline, and telemetry-delivery checks pending a manual
  AT pass. Evidence: WALKTHROUGH/results/runtime-sweep-2026-05-29.md; body
  re-derived 2026-06-03 from current source (lane-console architecture)'
---

# Studio · Yemaya · Auth

## Purpose

Aggregator workspace that composes the Yemaya identity-and-access admin lanes —
RBAC, organization management, and compliance/audit — under a four-card
capability summary. It issues no `/v1` fetch of its own; each embedded lane runs
its own real-backed engine.

## Entry points

- Breadcrumb chain on this page: **Studio › Yemaya RBAC › Auth**.
- Reachable from the Studio index and from sibling Yemaya routes (`rbac` links
  here).
- Direct URL / bookmark (signed-in + studio entitlement).

## Layout regions

`page.tsx` renders `ShellLayout active="studio"` and:

- **Breadcrumbs panel** (`data-yemaya-auth-breadcrumbs`): Studio › Yemaya RBAC ›
  Auth.
- **Workspace panel** (`StudioYemayaAuthWorkspace`,
  `data-yemaya-auth-workspace`):
  - `<h1>` "Yemaya Auth Workspace" (`WorkspaceHeading`).
  - Summary paragraph (`data-yemaya-auth-summary`).
  - **Capability Summary** (`data-yemaya-auth-capability-summary`): `<h2>` + four
    cards — Identity Access Orchestration, RBAC Policy Governance, Tenant and
    Compliance Controls, Security and Parity.
  - **RBAC Lane** (`data-yemaya-auth-rbac-lane`) — embedded
    `StudioYemayaRbacWorkspace` (the role/permission console documented in
    [`studio-yemaya-rbac.md`](./studio-yemaya-rbac.md)).
  - **Organization Management Lane** (`data-yemaya-auth-organization-lane`) —
    embedded `StudioYemayaOrganizationManagementWorkspace`.
  - **Compliance and Audit Lane** (`data-yemaya-auth-compliance-lane`) — embedded
    `StudioYemayaComplianceAndAuditWorkspace`.
- **Route Map panel** (`data-yemaya-auth-route-map`): `<h2>` "Route Map" + six
  `STUDIO_YEMAYA_AUTH_ROUTE_MAP` entries.
- **Quick-action panel**: four `quickAction` links.

## States

Per embedded lane (this page has no fetch of its own):

- [ ] **RBAC Lane** — its own loading / unauthorized / error / ready / result
      states; see [`studio-yemaya-rbac.md`](./studio-yemaya-rbac.md).
- [ ] **Organization Management Lane** — its own lane states.
- [ ] **Compliance and Audit Lane** — its own lane states.
- [ ] **Capability Summary** — static four-card panel, always rendered.

## Interactions

### Breadcrumbs

- [ ] **"Studio"** (link) → `/studio`
- [ ] **"Yemaya RBAC"** (link) → `/studio/yemaya/rbac`
- [ ] **"Auth"** (current page) — `aria-current="page"`.

### Embedded lanes

- [ ] **RBAC Lane** — `StudioYemayaRbacWorkspace`; see
      [`studio-yemaya-rbac.md`](./studio-yemaya-rbac.md).
- [ ] **Organization Management Lane** —
      `StudioYemayaOrganizationManagementWorkspace`.
- [ ] **Compliance and Audit Lane** —
      `StudioYemayaComplianceAndAuditWorkspace`.

### Route map

`data-yemaya-auth-route-map` — six entries:

- [ ] `/studio/yemaya/auth`
- [ ] `/studio/yemaya/auth/sessions/[sessionId]`
- [ ] `/studio/yemaya/auth/policies/[policyId]`
- [ ] `/studio/yemaya/auth/tenants/[tenantId]`
- [ ] `/studio/yemaya/auth/parity/[parityId]`
- [ ] `/studio/yemaya/auth/governance/[governanceId]`

### Quick actions

- [ ] **"Open Yemaya RBAC workspace"** → `/studio/yemaya/rbac`.
- [ ] **"Open Yemaya Compliance and Audit workspace"** →
      `/studio/yemaya/compliance-and-audit`.
- [ ] **"Open Yemaya Organization Management workspace"** →
      `/studio/yemaya/organization-management`.
- [ ] **"Back to Studio workspace index"** → `/studio`.

## Data & contracts

- **Reads / Writes**: none at the aggregator boundary; each embedded lane issues
  its own admin GET catalog + POST verb.
- **Realtime**: none.
- **Caching**: delegated to the embedded lanes (client fetch on mount,
  `cache: 'no-store'`).
- **Auth/role check**: admin-scoped fail-closed inside each lane, behind the
  proxy studio gate.

## Cross-references

- Studio overview: [`studio-overview.md`](../../studio-overview.md)
- Workspace source:
  `apps/oshun/web/src/components/studio/StudioYemayaAuthWorkspace.tsx`
- Route map source:
  `apps/oshun/web/src/components/studio/StudioYemayaAuthRouteMap.ts`
- Embedded lane:
  `apps/oshun/web/src/components/studio/StudioYemayaRbacWorkspace.tsx`
- Sibling per-view docs:
  [`studio-yemaya-rbac.md`](./studio-yemaya-rbac.md),
  [`studio-yemaya-organizations.md`](./studio-yemaya-organizations.md)
- Shell auth model:
  [`shell/04-auth-session.md`](../../../shell/04-auth-session.md)
- Feature spec: [`V1/features.md`](../../../../V1/features.md)

## Open questions / known gaps

- [ ] The Route Map advertises sessions / policies / tenants / parity /
      governance sub-routes; confirm whether those dynamic children exist as
      `page.tsx` files yet.