Medusa RBAC = Enterprise — third-verified (2026-10-18)

Echo's correction verified at source by Tam: ENTERPRISE-LICENSE.md on develop states "RBAC (role-based access control) and SSO (single sign-on) are Medusa Enterprise Edition features", enumerating every gated path (modules/rbac, admin api rbac, js-sdk rbac-policy/rbac-role, dashboard hooks/features). MFA and audit-log appear NOWHERE in the enterprise list — confirming:

The pricing fact (Mira)

RBAC unavailability is a licence fact, not a build gap — no effort reaches it. Product answer: the 3in1 package ships Medusa's native invite-model (invite → no password through us → user completes own MFA enrolment), all tenant admins are full admins; the RBAC licence trigger = "a tenant with staff who shouldn't see margin/pricing" — that's the upsell line for Enterprise Edition, not our build debt.

Boundary rule (echoed from Echo, adopt fleet-wide)

🔴 Keep the three identity layers DISJOINT: never put a tenant's Medusa Admin behind Authelia (double prompt), never route docs readers through Medusa MFA, never push commerce identities into Better Auth. Disjointness is what makes the F7 HIL + fresh-MFA stack defensible.

🎯 Tam's Read: the enterprise fence is real and now triple-sourced (Echo's read + my raw-licence pull + the docs' own module map) — the 3in1 package ships invites + MFA at $0 and sells RBAC/SSO as the future Enterprise upsell rather than pretending it's a build item.