# DEB-306: ?

> **Jira:** [DEB-306](https://divami.atlassian.net/browse/DEB-306)  
> **Source Report:** [20260315.md](../../reports/jira/20260315.md)

- **Status:** Start
- **Assignee:** Unassigned
- **Priority:** Medium
- **Created:** 2026-03-13T13:56:39.102+0530
- **Updated:** 2026-03-13T13:56:39.198+0530

**Description:**

Prepare a plan and discuss for the Governance Lifecycle - How Agents should respect RBAC

**Architecture Diagram:**

```mermaid
flowchart TD
    A[User JWT Token] --> B[Extract roles & permissions]
    B --> C[RT Decision Agent<br/>Governance Layer]
    C --> D[A2A request with RBAC metadata]
    D --> E[DSA: RBAC Controller]
    E --> F{Role-based policy check}
    F -->|Trainer role| G[Allow training updates]
    F -->|Admin role| H[Allow config & governance changes]
    F -->|User role| I[Read-only query access]
    F -->|No access| J[Return 403 with message]
    G & H & I --> K[Execute with scoped permissions]
```