## Context
ARCHITECTURE_RULES §6 requires every cross-cutting concern (auth, tenancy,
audit, feature flags, ...) to have one declaration point, one enforcement point,
and one CI gate, and §6.1 spells this out for authorization. `docir` is a
single-user local CLI: there are no actors, permissions, tenants, roles, or
multi-user access. There is nothing to declare or enforce.

## Decision
Do not build `platform/authz`, a permission registry, or per-operation policy
declarations. Record that §6 and §6.1 are intentionally not instantiated because
the system has no cross-cutting concern of that kind. The other enforcement
checks that DO apply are kept: boundary/interface/layer/cycle (tach),
contract-sync, dead-code (vulture), lint, types, and tests.

## Consequences
- Easier: no machinery that enforces nothing; the `api` surface stays focused on
  document/tag/index operations.
- Harder: nothing today.
- If `docir` ever grows real actors (e.g. a shared server), a cross-cutting
  authorization concern must be introduced per §6, superseding this ADR.