# AVP / Cedar Migration — Shadow Mode Checklist (July 2026)

## Inventory

- [ ] Export roles/permissions → (action, resource_type) map
- [ ] Grep app for `hasPermission` / `can(` / role checks
- [ ] Define Cedar schema + entity hierarchy (User / Team / Tenant / Resource)

## Shadow

- [ ] Call legacy RBAC + `IsAuthorized` (or `BatchIsAuthorized`) in parallel
- [ ] Metric on decision divergence; fix policies until edge cases are intentional
- [ ] Still **enforce** legacy until cutover

## Cutover

- [ ] Read routes first; destructive actions last
- [ ] CloudTrail on authorization APIs for audit
- [ ] Offline: `cedar authorize` against policy + entities fixtures

## Counter-case

AVP does not replace Cognito auth or IAM for AWS APIs — only app-domain authorization.