CI / CI (pull_request) Successful in 3m11s
Authentik client_credentials tokens don't carry roles/permissions claims (scope mappings not evaluated). Capabilities are carried as space-separated scope values instead. Gateway now checks scope claim as fallback after roles and permissions.