feat(security): ABAC P2/P3-lite — BIG-nummer redaction, authz audit, guard; clear dev audit

- fix(deps): pin @babel/core ^7.29.7 via overrides → npm audit 0 (dev+prod),
  no --force / no Angular downgrade; README corrected
- feat(brief): field-level PII reveal (PRD-0002 §5c) — CaseContext BIG-nummer
  ships masked; step-up-stubbed (X-Step-Up), audited POST /brief/reveal-bignummer
  unmasks it; drafter-only capability, deny-by-default. Realized on the BIG-nummer
  (no BSN on the wire)
- feat(authz): no-PII AuditAuthz log for reveal attempts + org-admin denials (§8)
- feat(routes): wire capabilityGuard('orgtemplate:edit') onto brief/huisstijl (§6)
- test: backend +5 (Authz + reveal endpoint), FE +3 (adapter boundary, store swap)
- docs: PRD-0002 §5c/§9, WP-18 follow-up, README

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/backlog/WP-18-abac-capability-spine.md

@@ -3,6 +3,18 @@
 Status: done (7ec13d8)
 Phase: 5 — productie-volwassenheid
 
+> **Follow-up (P2/P3-lite delivered later).** On top of this P1 spine:
+> - **P2 field-level PII (§5c):** the case screen's **BIG-nummer** now ships masked
+>   (`Authz.CanRevealBigNummer` + `BriefDecisionsDto.CanRevealBigNummer`); a
+>   step-up-stubbed (`X-Step-Up` header), audited `POST /brief/reveal-bignummer` unmasks
+>   it. Realized on the BIG-nummer, not the BSN, because **no BSN travels the wire** (see
+>   PRD-0002 §5c note).
+> - **P3-lite audit + guard (§8, §6):** a no-PII `AuditAuthz` log line records reveal
+>   attempts (allow/deny) and org-admin denials; the already-built `capabilityGuard` is
+>   now wired onto the `brief/huisstijl` admin route.
+>
+> Still unbuilt: data-scoping (§5b), real step-up/MFA, break-glass.
+
 ## Why
 
 The single biggest gap between this POC and a production SSP: identity carries no

docs/prd/0002-attribute-based-access-control.md

@@ -137,6 +137,12 @@ canonical case (art. 9 / special-category data):
 - A `canRevealBsn` flag gates an explicit reveal action; reveal requires **step-up** (§5d) and is
   **audited** (§8).
 
+> **Implementation note.** No **BSN** actually travels the wire in this POC (the BSN lives only in
+> the faked login and is never persisted). The sensitive identifier the backend *does* serve is the
+> **BIG-nummer** on the backoffice case screen (`CaseContextDto`), so the delivered field-level reveal
+> is realized there (`canRevealBigNummer`, `POST /brief/reveal-bignummer`) — the on-the-wire
+> equivalent of this BSN illustration.
+
 Precedent already in the code: the client persists **only `naam`, never the BSN**, to `sessionStorage`
 (`src/app/auth/application/session.store.ts:40-47`) — this PRD generalizes that instinct to every PII
 field, enforced server-side.
@@ -224,7 +230,14 @@ action, resource, env)`), used **on every endpoint** — not merely to _emit_ fl
   Convert the brief drafter/approver gate from `currentRole()` to a real `brief:approve` capability
   (verified principal, keep the SoD `approver != drafter` check).
 - **P2 — Data + field.** Row-level scoping on list endpoints; server-side PII redaction + `canRevealBsn`.
+  - _Field-level reveal delivered_ (WP-18 follow-up): the backoffice case screen ships the
+    **BIG-nummer** masked (`Authz.CanRevealBigNummer` + `BriefDecisionsDto.CanRevealBigNummer`),
+    revealed by the step-up-gated, audited `POST /brief/reveal-bignummer`. Realized on the
+    BIG-nummer, **not the BSN** — see the §5c note. Row-level scoping (§5b) still unbuilt.
 - **P3 — Step-up & audit.** MFA/assurance preconditions, break-glass, and the authorization audit log.
+  - _Audit log delivered (lite)_: `AuditAuthz` logs reveal attempts (allow/deny) and
+    org-admin denials, no PII (§8). Step-up is stubbed as the `X-Step-Up` header (§5d); the
+    `capabilityGuard` is wired onto the admin route (§6). MFA and break-glass still unbuilt.
 
 ## 10. Cross-references