AccountAuthz is the authorization layer for multi-tenant apps. The app declares a fixed catalog of capabilities (permission + metric keys) in code; accounts manage roles as data that bundle those capabilities; AccountAuthz resolves what a member may do (can?) and which metrics they may see (approved_metrics) from their roles, and plugs into Pundit for enforcement.