Merge branch 'dev' into feature/1058-adminfront-tab-rebac-permissions

.gitea/workflows/code_check.yml

@@ -131,7 +131,8 @@ jobs:
 
                   global='^(\.gitea/workflows/code_check\.yml|Makefile|scripts/|tools/|test/code_check_)'
                   front_shared='^(common/|scripts/playwrightPackageVersion\.cjs|scripts/summarize_vitest_coverage\.mjs|scripts/run_adminfront_ci_tests\.sh|\.gitea/workflows/code_check\.yml|Makefile)'
-                  i18n_shared='^(common/locales/|userfront/assets/translations/|scripts/sync_userfront_locales\.sh|tools/i18n-scanner/)'
+                  i18n_shared='^(locales/|common/locales/|userfront/assets/translations/|scripts/sync_userfront_locales\.sh|tools/i18n-scanner/)'
+                  react_i18n='^(adminfront/src/locales/|devfront/src/locales/|orgfront/src/locales/)'
 
                   backend=false
                   userfront=false
@@ -154,7 +155,7 @@ jobs:
                   if matches "$front_shared|^adminfront/|^devfront/|^orgfront/"; then biome=true; fi
 
                   lint=false
-                  if [ "$backend" = true ] || [ "$userfront" = true ] || [ "$adminfront" = true ] || [ "$devfront" = true ] || [ "$orgfront" = true ] || matches "$i18n_shared"; then
+                  if [ "$backend" = true ] || [ "$userfront" = true ] || matches "$global|$i18n_shared|$react_i18n"; then
                     lint=true
                   fi
 
@@ -213,42 +214,6 @@ jobs:
                   channel: "stable"
                   cache: true
 
-            - name: Install adminfront dependencies
-              run: |
-                  cd adminfront
-                  npx pnpm install -C ../common --no-frozen-lockfile
-                  npx pnpm install --no-frozen-lockfile
-
-            - name: Biome check adminfront (lint + format)
-              run: |
-                  cd adminfront
-                  npx biome check . --formatter-enabled=false --assist-enabled=false
-                  npx biome check . --linter-enabled=false --assist-enabled=false
-
-            - name: Install devfront dependencies
-              run: |
-                  cd devfront
-                  npx pnpm install -C ../common --no-frozen-lockfile
-                  npx pnpm install --no-frozen-lockfile
-
-            - name: Biome check devfront (lint + format)
-              run: |
-                  cd devfront
-                  npx biome check . --formatter-enabled=false --assist-enabled=false
-                  npx biome check . --linter-enabled=false --assist-enabled=false
-
-            - name: Install orgfront dependencies
-              run: |
-                  cd orgfront
-                  npx pnpm install -C ../common --no-frozen-lockfile
-                  npx pnpm install --no-frozen-lockfile
-
-            - name: Biome check orgfront (lint + format)
-              run: |
-                  cd orgfront
-                  npx biome check . --formatter-enabled=false --assist-enabled=false
-                  npx biome check . --linter-enabled=false --assist-enabled=false
-
             - name: Lint Go backend
               run: |
                   docker run --rm \
@@ -879,7 +844,7 @@ jobs:
     adminfront-vitest-coverage:
         needs:
             - changes
-            - lint
+            - biome-check
         if: ${{ always() && needs.changes.outputs.adminfront == 'true' && (github.event_name != 'workflow_dispatch' || inputs.run_front_coverage == true) }}
         runs-on: ubuntu-latest
         steps:
@@ -1010,7 +975,7 @@ jobs:
     devfront-vitest-coverage:
         needs:
             - changes
-            - lint
+            - biome-check
         if: ${{ always() && needs.changes.outputs.devfront == 'true' && (github.event_name != 'workflow_dispatch' || inputs.run_front_coverage == true) }}
         runs-on: ubuntu-latest
         steps:
@@ -1141,7 +1106,7 @@ jobs:
     orgfront-vitest-coverage:
         needs:
             - changes
-            - lint
+            - biome-check
         if: ${{ always() && needs.changes.outputs.orgfront == 'true' && (github.event_name != 'workflow_dispatch' || inputs.run_front_coverage == true) }}
         runs-on: ubuntu-latest
         steps:
@@ -1272,7 +1237,7 @@ jobs:
     adminfront-tests:
         needs:
             - changes
-            - lint
+            - biome-check
         if: ${{ always() && needs.changes.outputs.adminfront == 'true' && (github.event_name != 'workflow_dispatch' || inputs.run_adminfront_tests == true) }}
         runs-on: ubuntu-latest
         timeout-minutes: 30
@@ -1367,7 +1332,7 @@ jobs:
     devfront-tests:
         needs:
             - changes
-            - lint
+            - biome-check
         if: ${{ always() && needs.changes.outputs.devfront == 'true' && (github.event_name != 'workflow_dispatch' || inputs.run_devfront_tests == true) }}
         runs-on: ubuntu-latest
         steps:
@@ -1550,7 +1515,7 @@ jobs:
     orgfront-tests:
         needs:
             - changes
-            - lint
+            - biome-check
         if: ${{ always() && needs.changes.outputs.orgfront == 'true' && (github.event_name != 'workflow_dispatch' || inputs.run_orgfront_tests == true) }}
         runs-on: ubuntu-latest
         steps:

Makefile

@@ -340,7 +340,11 @@ code-check-userfront-lint:
 code-check-front-lint:
 	@echo "==> adminfront biome lint/format check"
 	rm -rf adminfront/playwright-report adminfront/test-results
-	cd adminfront && CI=true npx pnpm install --frozen-lockfile --ignore-scripts
+	@if [ -d adminfront/node_modules ]; then \
+		echo "adminfront/node_modules already present; skipping pnpm install."; \
+	else \
+		cd adminfront && CI=true npx pnpm install --frozen-lockfile --ignore-scripts; \
+	fi
 	cd adminfront && npx biome lint .
 	cd adminfront && npx biome format .
 	@echo "==> devfront biome lint/format check"
@@ -354,9 +358,13 @@ code-check-front-lint:
 	cd devfront && npx biome format .
 	@echo "==> orgfront biome lint/format check"
 	rm -rf orgfront/playwright-report orgfront/test-results
-	cd orgfront && npm ci --ignore-scripts
-	cd orgfront && npx biome lint .
-	cd orgfront && npx biome format .
+	@if [ -d orgfront/node_modules ]; then \
+		echo "orgfront/node_modules already present; skipping npm install."; \
+	else \
+		cd orgfront && npm ci --ignore-scripts; \
+	fi
+	cd orgfront && ./node_modules/@biomejs/biome/bin/biome lint .
+	cd orgfront && ./node_modules/@biomejs/biome/bin/biome format .
 
 code-check-backend-tests:
 	@echo "==> backend tests"

README.md

@@ -380,21 +380,23 @@ Kratos가 사용자 SoT이며 Hydra는 순수 OIDC 토큰 엔진입니다. 비
 
 ### SSOT 및 Redis Cache 전략
 
-Baron SSO는 “하나의 DB가 모든 데이터의 원본”인 구조가 아닙니다. 데이터 성격별로 원장이 다르며, Backend는 원장 쓰기 경로와 감사 로그를 중앙화하는 Control Plane입니다. Redis와 PostgreSQL projection은 성능과 운영 편의를 위한 read model/cache로만 사용하고, 원장과 불일치할 수 있다는 전제를 명시합니다.
+Baron SSO의 인증, 권한, OAuth/OIDC 원장은 Ory Stack입니다. Backend는 원장 쓰기 경로와 감사 로그를 중앙화하는 Control Plane이며, Ory에 저장되지 않거나 Ory API로 필요한 방식의 조회가 불가능한 데이터만 read model로 보관합니다. Redis는 원장 데이터와 허용된 read model의 성능 cache/mirror로만 사용합니다.
+
+Ory에서 Redis cache로 웜업된 identity/조직 데이터는 frontend가 직접 소비하지 않습니다. Backend가 Redis와 허용된 read model을 조합해 cursor 기반 API로 adminfront, orgfront, userfront, 외부 API에 제공합니다.
 
 #### 데이터별 원본 위치
 
 | 데이터 | SSOT | 보조 저장소/캐시 | 비고 |
 | --- | --- | --- | --- |
 | Identity subject, credentials, recovery/verification address | Ory Kratos `identities` | Redis identity mirror, PostgreSQL `users.id` 참조 | Kratos identity ID가 사용자 subject이며 WORKS `externalKey` 기준입니다. |
-| 로그인 식별자 | Kratos traits, `user_login_ids` | Redis identity mirror | Kratos는 인증 식별자, PostgreSQL은 중복/정책 검증용 index입니다. |
-| 사용자 이름, 이메일, 전화번호, role 기본값 | Kratos traits | PostgreSQL `users`, Redis mirror | 인증/profile 계산에 필요한 최소 identity 값만 Kratos에 유지합니다. |
-| Baron 사용자 상태, soft delete, 운영 메타데이터 | PostgreSQL `users`, `users.metadata` | Redis mirror 조합 응답 | `users.deleted_at`은 Baron 운영 상태이며 Kratos identity 삭제와 같은 의미가 아닙니다. |
-| 테넌트 tree, slug, 조직/부서/직무/직책 | PostgreSQL `tenants`, `users`, membership metadata | Redis/API response cache 가능 | 관계형 조직 데이터는 Kratos traits가 아니라 Backend DB가 원장입니다. |
+| 로그인 식별자 | Ory Kratos traits | Redis identity mirror, `user_login_ids` read model | Kratos가 인증 식별자의 원장이고 Backend DB는 중복/정책 검증용 read model입니다. |
+| 사용자 이름, 이메일, 전화번호, role 기본값 | Ory Kratos traits | Redis identity mirror, PostgreSQL `users` read model | 인증/profile 계산에 필요한 최소 identity 값만 Kratos에 유지합니다. |
+| Baron 사용자 운영 상태, soft delete, 운영 메타데이터 | Backend read model | Redis 조합 응답 cache | Ory에 같은 의미로 저장되거나 조회되지 않는 Baron 운영 데이터입니다. Kratos identity 삭제와 혼동하지 않습니다. |
+| 테넌트 tree, slug, 조직/부서/직무/직책 | Ory Keto relation tuple, Backend read model | Redis/API response cache 가능 | 권한/관계 판단은 Keto가 원장입니다. Ory가 보관하거나 조회할 수 없는 조직 표시/검색 데이터만 Backend read model에 둡니다. |
 | 권한/관계 | Ory Keto relation tuple | PostgreSQL outbox/status | Backend를 통해 relation command를 보내고 처리 상태를 추적합니다. |
 | OAuth2/OIDC client, consent, token state | Ory Hydra | PostgreSQL `client_consents`, audit/read model | Hydra가 프로토콜 원장이며 로컬 테이블은 운영 조회/감사용입니다. |
-| RP별 사용자 custom claim 값 | PostgreSQL `rp_user_metadata` | ID token/userinfo projection | RP 관리자 범위 데이터이며 전역 claim과 분리합니다. |
-| 전역 사용자 custom claim 값 | PostgreSQL `users.metadata.global_custom_claims` | ID token projection | 전체 사용자 대상 claim으로 adminfront 사용자 상세에서만 관리합니다. |
+| RP별 사용자 custom claim 값 | Backend read model `rp_user_metadata` | ID token/userinfo claim assembly | Ory에 저장되지 않는 RP 범위 데이터입니다. Kratos traits나 claim output을 SSOT로 취급하지 않습니다. |
+| 전역 사용자 custom claim 값 | Backend read model `users.metadata.global_custom_claims` | ID token claim assembly | Ory에 저장되지 않는 운영 범위 custom 값입니다. |
 | WORKS Mobile mapping/outbox/job 상태 | PostgreSQL `worksmobile_*` | WORKS API 비교 응답 cache 가능 | 외부 SaaS 연동 상태이며 identity 원장이 아닙니다. |
 | 감사 로그/사용량 | ClickHouse, Oathkeeper/Ory 로그 | 화면별 summary cache 가능 | command와 보안 이벤트의 감사 원장입니다. |
 | Headless JWKS 검증 상태 | Redis `headless:jwks:*` cache | DevFront 상태 카드 | RP public key 문서 자체는 외부 `jwksUri`가 원본입니다. |
@@ -403,11 +405,11 @@ Baron SSO는 “하나의 DB가 모든 데이터의 원본”인 구조가 아
 #### SSOT 보장 원칙
 
 1. Kratos/Hydra/Keto/WORKS로 향하는 쓰기 command는 Backend를 통과합니다.
-2. Backend는 원장 write 성공 후 원장 ID를 기준으로 재조회하고, PostgreSQL read model 또는 Redis mirror를 write-through 갱신합니다.
+2. Backend는 Ory write 성공 후 원장 ID를 기준으로 Ory를 재조회하고, Redis mirror를 갱신하거나 stale로 표시합니다. Backend DB 갱신은 Ory에 저장되지 않거나 조회가 불가능한 read model에 한정합니다.
 3. write-through 갱신 실패 시 원장 write를 되돌린 것으로 간주하지 않습니다. 대신 mirror/cache 상태를 `stale` 또는 `failed`로 표시하고 drift report와 refresh 대상으로 둡니다.
 4. Kratos Admin API 또는 Kratos DB를 Backend 밖에서 직접 수정하는 경로는 운영 정책상 금지합니다. 정비/DR처럼 예외가 필요한 경우에는 Redis mirror를 stale로 표시하고, full refresh와 drift report를 완료하기 전까지 cache 결과를 신뢰하지 않습니다.
-5. PostgreSQL projection은 Kratos partial list를 full snapshot처럼 취급하지 않습니다. Kratos 목록 조회가 partial이면 로컬 사용자를 삭제/숨김 처리하지 않습니다.
-6. frontend 대량 조회는 cursor 기반을 원칙으로 합니다. `limit=5000&offset=0` 같은 단일 대량 offset 조회는 사용자 수가 늘면 partial data를 전체처럼 보이게 만들 수 있으므로 신규 구현에서 금지합니다.
+5. Backend read model이나 Redis cache는 Kratos partial list를 full snapshot처럼 취급하지 않습니다. Kratos 목록 조회가 partial이면 로컬 사용자를 삭제/숨김 처리하지 않습니다.
+6. frontend/API 대량 조회는 Backend가 제공하는 cursor 기반을 원칙으로 합니다. `limit=5000&offset=0` 같은 단일 대량 offset 조회는 사용자 수가 늘면 partial data를 전체처럼 보이게 만들 수 있으므로 신규 구현에서 금지합니다.
 7. Redis cache miss가 발생한 단건 조회는 가능한 경우 SSOT로 fallback하고, fallback 성공 시 Redis를 갱신합니다. 목록 조회는 mirror 상태가 `ready`가 아니면 화면/API에 경고 상태를 함께 전달해야 합니다.
 
 #### Redis 사용 원칙
@@ -417,7 +419,7 @@ Redis는 원장이 아니라 cache/mirror 계층입니다. Redis 데이터 유
 | Redis 데이터 | 역할 | TTL/보존 정책 | 장애 시 처리 |
 | --- | --- | --- | --- |
 | `identity:mirror:{identityID}` | Kratos identity summary 단건 cache | 장기 mirror. refresh 상태와 함께 운영 | Kratos `GetIdentity` fallback 후 write-through |
-| `identity:index:*` | identity 목록/검색 cursor index | mirror refresh 주기로 재작성 | `stale` 표시 후 full refresh |
+| `identity:index:*` | Backend cursor API용 identity 목록/검색 index | mirror refresh 주기로 재작성 | `stale` 표시 후 full refresh |
 | `identity:mirror:state` | mirror 상태, count, last error | 영구 상태 key | adminfront에서 경고 표시 |
 | `headless:jwks:*` | RP headless login JWKS cache | JWKS TTL과 prefetch 정책 | kid miss/검증 실패/TTL 만료 시 재조회 |
 | login/verification/pending 계열 key | 인증 흐름의 단기 상태 | 짧은 TTL 필수 | 만료 또는 유실 시 사용자가 흐름 재시작 |

adminfront/src/components/ui/use-toast.ts

@@ -18,6 +18,11 @@ const notify = () => {
 };
 
 const toastBase = (message: string, type: ToastType = "success") => {
+  if (
+    toasts.some((toast) => toast.message === message && toast.type === type)
+  ) {
+    return;
+  }
   const id = Math.random().toString(36).substring(2, 9);
   toasts = [...toasts, { id, message, type }];
   notify();

adminfront/src/features/coverage/adminTenantTabs.test.tsx

@@ -16,6 +16,7 @@ const exportUsersCSVMock = vi.hoisted(() =>
     filename: "users_export_20260609.csv",
   })),
 );
+const bulkUpdateUsersMock = vi.hoisted(() => vi.fn(async () => ({ results: [] })));
 
 const tenants = [
   {
@@ -127,6 +128,7 @@ vi.mock("../../lib/adminApi", () => ({
   })),
   updateTenant: vi.fn(async () => tenants[2]),
   updateUser: vi.fn(async () => users[2]),
+  bulkUpdateUsers: bulkUpdateUsersMock,
   exportTenantsCSV: vi.fn(async () => ({
     blob: new Blob(["name,slug"]),
     filename: "tenants.csv",
@@ -227,4 +229,48 @@ describe("admin tenant tab coverage smoke", () => {
       expect(exportUsersCSVMock).toHaveBeenCalledWith("", "gpdtdc", false);
     });
   });
+
+  it("queues searched users and bulk adds them to the selected organization", async () => {
+    renderWithProviders(
+      <Routes>
+        <Route
+          path="/tenants/:tenantId/organization"
+          element={<TenantUserGroupsTab />}
+        />
+      </Routes>,
+      "/tenants/tenant-company/organization",
+    );
+
+    expect(await screen.findByText("Member User")).toBeInTheDocument();
+
+    fireEvent.click(screen.getByRole("button", { name: /멤버 추가/ }));
+    fireEvent.change(screen.getByTestId("tenant-org-member-search-input"), {
+      target: { value: "user" },
+    });
+    fireEvent.click(screen.getByTestId("tenant-org-member-search-btn"));
+
+    fireEvent.click(
+      await screen.findByTestId("tenant-org-member-search-result-user-owner"),
+    );
+    fireEvent.click(
+      await screen.findByTestId("tenant-org-member-search-result-user-admin"),
+    );
+
+    expect(screen.getByTestId("tenant-org-member-add-queue")).toHaveTextContent(
+      "Owner User",
+    );
+    expect(screen.getByTestId("tenant-org-member-add-queue")).toHaveTextContent(
+      "Admin User",
+    );
+
+    fireEvent.click(screen.getByTestId("tenant-org-member-add-submit-btn"));
+
+    await waitFor(() => {
+      expect(bulkUpdateUsersMock).toHaveBeenCalledWith({
+        userIds: ["user-owner", "user-admin"],
+        tenantSlug: "gpdtdc",
+        isAddTenant: true,
+      });
+    });
+  });
 });

adminfront/src/features/integrity/DataIntegrityPage.test.tsx

@@ -5,8 +5,8 @@ import {
   deleteOrphanUserLoginIDs,
   fetchDataIntegrityReport,
   fetchMe,
-  fetchOrySSOTSystemStatus,
   fetchOrphanUserLoginIDs,
+  fetchOrySSOTSystemStatus,
   flushIdentityCache,
 } from "../../lib/adminApi";
 import { expectNoAnonymousFormFields } from "../../test/formFieldDiagnostics";

adminfront/src/features/tenants/routes/TenantListPage.test.ts

@@ -2,6 +2,7 @@ import { describe, expect, it } from "vitest";
 import type { TenantSummary } from "../../../lib/adminApi";
 import {
   filterTenantsByScope,
+  filterTenantViewRowsBySearch,
   getTenantSearchMatchIds,
   getTenantViewRows,
   resolveTenantSelectionIds,
@@ -97,4 +98,17 @@ describe("TenantListPage tenant list helpers", () => {
     ]);
     expect(getTenantSearchMatchIds(treeRows, "platform")).toEqual(["team-1"]);
   });
+
+  it("filters displayed tenant rows to direct matches only", () => {
+    const treeRows = getTenantViewRows(
+      tenants.filter((item) => item.id !== "company-2"),
+      "tree",
+      "",
+      true,
+    );
+
+    expect(
+      filterTenantViewRowsBySearch(treeRows, "team-1").map((row) => row.id),
+    ).toEqual(["team-1"]);
+  });
 });

adminfront/src/features/tenants/routes/TenantListPage.tsx

@@ -107,6 +107,7 @@ import {
 } from "../utils/tenantCsvImport";
 import {
   filterTenantsByScope,
+  filterTenantViewRowsBySearch,
   getTenantSearchMatchIds,
   getTenantViewRows,
   resolveTenantSelectionIds,
@@ -1667,11 +1668,12 @@ const TenantHierarchyView: React.FC<{
 
   const flattenedRows = React.useMemo(() => {
     if (viewMode === "table") {
-      return sortItems(
+      const rows = sortItems(
         getTenantViewRows(tenants, "table", scopeTenantId, !!search),
         sortConfig,
         tenantSortResolvers,
       );
+      return filterTenantViewRowsBySearch(rows, search);
     }
 
     const result: TenantViewRow[] = [];
@@ -1692,7 +1694,7 @@ const TenantHierarchyView: React.FC<{
       }
     };
     collect(subTree, 0);
-    return result;
+    return filterTenantViewRowsBySearch(result, search);
   }, [
     expandedIds,
     scopeTenantId,

adminfront/src/features/tenants/routes/TenantUsersPage.export.test.tsx

@@ -7,6 +7,7 @@ import TenantUsersPage from "./TenantUsersPage";
 
 const exportUsersCSVMock = vi.hoisted(() => vi.fn());
 const updateUserMock = vi.hoisted(() => vi.fn());
+const bulkUpdateUsersMock = vi.hoisted(() => vi.fn());
 const fetchUsersMock = vi.hoisted(() => vi.fn());
 
 vi.mock("../../../lib/i18n", () => createI18nMock());
@@ -18,6 +19,7 @@ vi.mock("../../../lib/adminApi", () => ({
     slug: "tech-planning",
   })),
   fetchUsers: fetchUsersMock,
+  bulkUpdateUsers: bulkUpdateUsersMock,
   exportUsersCSV: exportUsersCSVMock,
   updateUser: updateUserMock,
 }));
@@ -26,8 +28,7 @@ function renderTenantUsersPage() {
   const queryClient = new QueryClient({
     defaultOptions: { queries: { retry: false } },
   });
-
-  return render(
+  const result = render(
     <QueryClientProvider client={queryClient}>
       <MemoryRouter initialEntries={["/tenants/tenant-team-id/users"]}>
         <Routes>
@@ -39,12 +40,15 @@ function renderTenantUsersPage() {
       </MemoryRouter>
     </QueryClientProvider>,
   );
+
+  return { ...result, queryClient };
 }
 
 describe("TenantUsersPage export", () => {
   beforeEach(() => {
     exportUsersCSVMock.mockReset();
     updateUserMock.mockReset();
+    bulkUpdateUsersMock.mockReset();
     fetchUsersMock.mockReset();
     fetchUsersMock.mockResolvedValue({
       items: [
@@ -64,10 +68,12 @@ describe("TenantUsersPage export", () => {
       }),
       filename: "users_export_20260609.csv",
     });
+    updateUserMock.mockResolvedValue({});
     vi.spyOn(window.URL, "createObjectURL").mockReturnValue(
       "blob:tenant-users-export",
     );
     vi.spyOn(window.URL, "revokeObjectURL").mockImplementation(() => {});
+    bulkUpdateUsersMock.mockResolvedValue({ results: [] });
   });
 
   it("exports only the currently opened tenant users by tenant slug", async () => {
@@ -135,14 +141,121 @@ describe("TenantUsersPage export", () => {
     fireEvent.click(screen.getByTestId("tenant-member-add-submit-btn"));
 
     await waitFor(() => {
-      expect(updateUserMock).toHaveBeenCalledWith("user-2", {
+      expect(bulkUpdateUsersMock).toHaveBeenCalledWith({
+        userIds: ["user-2", "user-3"],
         tenantSlug: "tech-planning",
         isAddTenant: true,
       });
-      expect(updateUserMock).toHaveBeenCalledWith("user-3", {
+    });
+    expect(updateUserMock).not.toHaveBeenCalledWith(
+      expect.any(String),
+      expect.objectContaining({ isAddTenant: true }),
+    );
+  });
+
+  it("queues orgfront multi picker users and adds them with one bulk request", async () => {
+    fetchUsersMock
+      .mockResolvedValueOnce({
+        items: [
+          {
+            id: "existing-user",
+            name: "Existing",
+            email: "existing@example.com",
+            role: "user",
+            status: "active",
+          },
+        ],
+        total: 1,
+      })
+      .mockResolvedValue({ items: [], total: 0 });
+
+    renderTenantUsersPage();
+
+    const addButton = await screen.findByTestId(
+      "tenant-member-add-existing-btn",
+    );
+    await waitFor(() => expect(addButton).not.toBeDisabled());
+    fireEvent.click(addButton);
+
+    const picker = await screen.findByTitle("조직도에서 구성원 선택");
+    expect(decodeURIComponent(picker.getAttribute("src") ?? "")).toContain(
+      "/embed/picker?mode=multiple&select=user",
+    );
+
+    fireEvent(
+      window,
+      new MessageEvent("message", {
+        data: {
+          type: "orgfront:picker:confirm",
+          payload: {
+            mode: "multiple",
+            selections: [
+              { type: "tenant", id: "team-1", name: "플랫폼팀" },
+              {
+                type: "user",
+                id: "picked-user-1",
+                name: "Picked One",
+                email: "picked1@example.com",
+              },
+              {
+                type: "user",
+                id: "picked-user-2",
+                name: "Picked Two",
+              },
+              {
+                type: "user",
+                id: "existing-user",
+                name: "Existing",
+                email: "existing@example.com",
+              },
+            ],
+          },
+        },
+      }),
+    );
+
+    expect(screen.getByTestId("tenant-member-add-queue")).toHaveTextContent(
+      "Picked One",
+    );
+    expect(screen.getByTestId("tenant-member-add-queue")).toHaveTextContent(
+      "Picked Two",
+    );
+    expect(screen.getByTestId("tenant-member-add-queue")).not.toHaveTextContent(
+      "Existing",
+    );
+
+    fireEvent.click(screen.getByTestId("tenant-member-add-submit-btn"));
+
+    await waitFor(() => {
+      expect(bulkUpdateUsersMock).toHaveBeenCalledWith({
+        userIds: ["picked-user-1", "picked-user-2"],
         tenantSlug: "tech-planning",
         isAddTenant: true,
       });
     });
   });
+
+  it("removes a member from the tenant and invalidates the user detail cache", async () => {
+    const confirmSpy = vi.spyOn(window, "confirm").mockReturnValue(true);
+    const { queryClient } = renderTenantUsersPage();
+    queryClient.setQueryData(["user", "user-1"], {
+      id: "user-1",
+      name: "Alice",
+    });
+
+    await screen.findByText("Alice");
+
+    fireEvent.click(screen.getByTestId("tenant-member-remove-user-1"));
+
+    await waitFor(() => {
+      expect(updateUserMock).toHaveBeenCalledWith("user-1", {
+        tenantSlug: "tech-planning",
+        isRemoveTenant: true,
+      });
+    });
+    expect(queryClient.getQueryState(["user", "user-1"])?.isInvalidated).toBe(
+      true,
+    );
+    confirmSpy.mockRestore();
+  });
 });

adminfront/src/features/tenants/routes/TenantUsersPage.tsx

@@ -40,6 +40,7 @@ import {
 } from "../../../components/ui/table";
 import { toast } from "../../../components/ui/use-toast";
 import {
+  bulkUpdateUsers,
   exportUsersCSV,
   fetchTenant,
   fetchUsers,
@@ -47,6 +48,10 @@ import {
   updateUser,
 } from "../../../lib/adminApi";
 import { t } from "../../../lib/i18n";
+import {
+  buildAuthenticatedOrgChartUserMultiPickerUrl,
+  parseOrgChartUserSelections,
+} from "../../users/orgChartPicker";
 
 function TenantUsersPage() {
   const params = useParams<{ tenantId: string }>();
@@ -56,6 +61,13 @@ function TenantUsersPage() {
   const [addMembersOpen, setAddMembersOpen] = React.useState(false);
   const [memberSearch, setMemberSearch] = React.useState("");
   const [queuedMembers, setQueuedMembers] = React.useState<UserSummary[]>([]);
+  const orgChartMemberPickerUrl = React.useMemo(
+    () =>
+      buildAuthenticatedOrgChartUserMultiPickerUrl(
+        import.meta.env.ORGFRONT_URL,
+      ),
+    [],
+  );
 
   // 테넌트의 슬러그(tenantSlug)를 먼저 가져옴
   const tenantQuery = useQuery({
@@ -103,7 +115,7 @@ function TenantUsersPage() {
   const removeTenantMutation = useMutation({
     mutationFn: ({ userId, slug }: { userId: string; slug: string }) =>
       updateUser(userId, { tenantSlug: slug, isRemoveTenant: true }),
-    onSuccess: () => {
+    onSuccess: (_result, variables) => {
       toast.success(
         t(
           "msg.admin.tenants.members.remove_success",
@@ -111,6 +123,8 @@ function TenantUsersPage() {
         ),
       );
       usersQuery.refetch();
+      queryClient.invalidateQueries({ queryKey: ["users"] });
+      queryClient.invalidateQueries({ queryKey: ["user", variables.userId] });
       queryClient.invalidateQueries({ queryKey: ["tenant", tenantId] });
     },
     onError: (err: AxiosError<{ error?: string }>) => {
@@ -124,11 +138,11 @@ function TenantUsersPage() {
   const addMembersMutation = useMutation({
     mutationFn: async (members: UserSummary[]) => {
       if (!tenantSlug || members.length === 0) return;
-      await Promise.all(
-        members.map((member) =>
-          updateUser(member.id, { tenantSlug, isAddTenant: true }),
-        ),
-      );
+      await bulkUpdateUsers({
+        userIds: members.map((member) => member.id),
+        tenantSlug,
+        isAddTenant: true,
+      });
     },
     onSuccess: () => {
       const count = queuedMembers.length;
@@ -179,11 +193,27 @@ function TenantUsersPage() {
   );
   const searchResults = memberSearchQuery.data?.items ?? [];
 
+  const queueMembers = React.useCallback(
+    (members: UserSummary[]) => {
+      setQueuedMembers((current) => {
+        const blockedIds = new Set([
+          ...existingUserIds,
+          ...current.map((member) => member.id),
+        ]);
+        const next = [...current];
+        for (const member of members) {
+          if (blockedIds.has(member.id)) continue;
+          blockedIds.add(member.id);
+          next.push(member);
+        }
+        return next;
+      });
+    },
+    [existingUserIds],
+  );
+
   const queueMember = (member: UserSummary) => {
-    if (existingUserIds.has(member.id) || queuedUserIds.has(member.id)) {
-      return;
-    }
-    setQueuedMembers((current) => [...current, member]);
+    queueMembers([member]);
   };
 
   const removeQueuedMember = (memberId: string) => {
@@ -192,6 +222,30 @@ function TenantUsersPage() {
     );
   };
 
+  React.useEffect(() => {
+    if (!addMembersOpen) return;
+
+    const onMessage = (event: MessageEvent) => {
+      const selections = parseOrgChartUserSelections(event.data);
+      if (selections.length === 0) return;
+
+      queueMembers(
+        selections.map((selection) => ({
+          id: selection.id,
+          name: selection.name,
+          email: selection.email,
+          role: "user",
+          status: "active",
+          createdAt: "",
+          updatedAt: "",
+        })),
+      );
+    };
+
+    window.addEventListener("message", onMessage);
+    return () => window.removeEventListener("message", onMessage);
+  }, [addMembersOpen, queueMembers]);
+
   return (
     <Card className="mt-6 bg-[var(--color-panel)] flex-1 flex flex-col min-h-0 overflow-hidden">
       <CardHeader className="flex-shrink-0 flex flex-row items-center justify-between">
@@ -244,7 +298,7 @@ function TenantUsersPage() {
         </div>
       </CardHeader>
       <Dialog open={addMembersOpen} onOpenChange={setAddMembersOpen}>
-        <DialogContent className="max-w-2xl">
+        <DialogContent className="max-w-5xl">
           <DialogHeader>
             <DialogTitle>
               {t("ui.admin.tenants.members.add_existing", "기존 멤버 배정")}
@@ -256,73 +310,86 @@ function TenantUsersPage() {
               )}
             </DialogDescription>
           </DialogHeader>
-          <div className="space-y-4">
-            <div className="relative">
-              <Search
-                size={16}
-                className="absolute left-3 top-1/2 -translate-y-1/2 text-muted-foreground"
-              />
-              <Input
-                value={memberSearch}
-                onChange={(event) => setMemberSearch(event.target.value)}
-                className="h-9 pl-9"
-                placeholder={t(
-                  "ui.admin.tenants.members.search_placeholder",
-                  "이름 또는 이메일 검색",
-                )}
-                data-testid="tenant-member-search-input"
-              />
-            </div>
-            <div className="rounded-md border">
-              <div className="max-h-56 overflow-auto">
-                {memberSearchTerm.length < 2 ? (
-                  <div className="px-3 py-6 text-center text-sm text-muted-foreground">
-                    {t(
-                      "ui.admin.tenants.members.search_min_length",
-                      "두 글자 이상 입력하세요.",
-                    )}
-                  </div>
-                ) : memberSearchQuery.isFetching ? (
-                  <div className="flex items-center justify-center gap-2 px-3 py-6 text-sm text-muted-foreground">
-                    <Loader2 size={16} className="animate-spin" />
-                    {t("ui.common.searching", "검색 중...")}
-                  </div>
-                ) : searchResults.length === 0 ? (
-                  <div className="px-3 py-6 text-center text-sm text-muted-foreground">
-                    {t("ui.common.no_results", "검색 결과가 없습니다.")}
-                  </div>
-                ) : (
-                  <div className="divide-y">
-                    {searchResults.map((user) => {
-                      const disabled =
-                        existingUserIds.has(user.id) ||
-                        queuedUserIds.has(user.id);
-                      return (
-                        <button
-                          key={user.id}
-                          type="button"
-                          className="flex w-full items-center justify-between gap-3 px-3 py-2 text-left text-sm hover:bg-muted/50 disabled:cursor-not-allowed disabled:opacity-50"
-                          disabled={disabled}
-                          onClick={() => queueMember(user)}
-                        >
-                          <span className="min-w-0">
-                            <span className="block truncate font-medium">
-                              {user.name}
+          <div className="grid gap-4 lg:grid-cols-[minmax(0,1fr)_minmax(360px,1.2fr)]">
+            <div className="space-y-3">
+              <div className="relative">
+                <Search
+                  size={16}
+                  className="absolute left-3 top-1/2 -translate-y-1/2 text-muted-foreground"
+                />
+                <Input
+                  value={memberSearch}
+                  onChange={(event) => setMemberSearch(event.target.value)}
+                  className="h-9 pl-9"
+                  placeholder={t(
+                    "ui.admin.tenants.members.search_placeholder",
+                    "이름 또는 이메일 검색",
+                  )}
+                  data-testid="tenant-member-search-input"
+                />
+              </div>
+              <div className="rounded-md border">
+                <div className="max-h-56 overflow-auto">
+                  {memberSearchTerm.length < 2 ? (
+                    <div className="px-3 py-6 text-center text-sm text-muted-foreground">
+                      {t(
+                        "ui.admin.tenants.members.search_min_length",
+                        "두 글자 이상 입력하세요.",
+                      )}
+                    </div>
+                  ) : memberSearchQuery.isFetching ? (
+                    <div className="flex items-center justify-center gap-2 px-3 py-6 text-sm text-muted-foreground">
+                      <Loader2 size={16} className="animate-spin" />
+                      {t("ui.common.searching", "검색 중...")}
+                    </div>
+                  ) : searchResults.length === 0 ? (
+                    <div className="px-3 py-6 text-center text-sm text-muted-foreground">
+                      {t("ui.common.no_results", "검색 결과가 없습니다.")}
+                    </div>
+                  ) : (
+                    <div className="divide-y">
+                      {searchResults.map((user) => {
+                        const disabled =
+                          existingUserIds.has(user.id) ||
+                          queuedUserIds.has(user.id);
+                        return (
+                          <button
+                            key={user.id}
+                            type="button"
+                            className="flex w-full items-center justify-between gap-3 px-3 py-2 text-left text-sm hover:bg-muted/50 disabled:cursor-not-allowed disabled:opacity-50"
+                            disabled={disabled}
+                            onClick={() => queueMember(user)}
+                          >
+                            <span className="min-w-0">
+                              <span className="block truncate font-medium">
+                                {user.name}
+                              </span>
+                              <span className="block truncate text-xs text-muted-foreground">
+                                {user.email}
+                              </span>
                             </span>
-                            <span className="block truncate text-xs text-muted-foreground">
-                              {user.email}
-                            </span>
-                          </span>
-                          <Plus size={16} className="flex-shrink-0" />
-                        </button>
-                      );
-                    })}
-                  </div>
-                )}
+                            <Plus size={16} className="flex-shrink-0" />
+                          </button>
+                        );
+                      })}
+                    </div>
+                  )}
+                </div>
               </div>
             </div>
+            <div className="min-h-[360px] overflow-hidden rounded-md border">
+              <iframe
+                title={t(
+                  "ui.admin.tenants.members.org_picker_title",
+                  "조직도에서 구성원 선택",
+                )}
+                src={orgChartMemberPickerUrl}
+                className="h-[420px] w-full"
+                data-testid="tenant-member-org-picker-frame"
+              />
+            </div>
             <div
-              className="min-h-20 rounded-md border bg-muted/20 p-3"
+              className="min-h-20 rounded-md border bg-muted/20 p-3 lg:col-span-2"
               data-testid="tenant-member-add-queue"
             >
               {queuedMembers.length === 0 ? (
@@ -398,12 +465,15 @@ function TenantUsersPage() {
                   <TableHead>
                     {t("ui.admin.tenants.members.table.status", "STATUS")}
                   </TableHead>
+                  <TableHead className="text-right">
+                    {t("ui.common.actions", "작업")}
+                  </TableHead>
                 </TableRow>
               </TableHeader>
               <TableBody>
                 {usersQuery.isLoading ? (
                   <TableRow>
-                    <TableCell colSpan={4} className="text-center py-20">
+                    <TableCell colSpan={5} className="text-center py-20">
                       <div className="flex flex-col items-center gap-2">
                         <Loader2
                           className="animate-spin text-muted-foreground"
@@ -418,7 +488,7 @@ function TenantUsersPage() {
                 ) : users.length === 0 ? (
                   <TableRow>
                     <TableCell
-                      colSpan={4}
+                      colSpan={5}
                       className="text-center py-8 text-muted-foreground"
                     >
                       {t(
@@ -460,6 +530,23 @@ function TenantUsersPage() {
                           {t(`ui.common.status.${user.status}`, user.status)}
                         </Badge>
                       </TableCell>
+                      <TableCell className="text-right">
+                        <Button
+                          variant="ghost"
+                          size="icon"
+                          aria-label={t(
+                            "ui.admin.tenants.members.remove",
+                            "구성원 제외",
+                          )}
+                          data-testid={`tenant-member-remove-${user.id}`}
+                          onClick={(event) => {
+                            event.stopPropagation();
+                            _handleRemoveMember(user.id, user.name);
+                          }}
+                        >
+                          <X size={16} />
+                        </Button>
+                      </TableCell>
                     </TableRow>
                   ))
                 )}

adminfront/src/features/tenants/routes/TenantWorksmobilePage.tsx

@@ -656,7 +656,7 @@ export function TenantWorksmobilePage() {
             actionDisabled={isCreatingUsers || createSelectedMutation.isPending}
             updateActionLabel="선택 구성원 업데이트 적용"
             onCreateSelected={(ids, initialPassword) =>
-              createSelectedMutation.mutate({
+              createSelectedMutation.mutateAsync({
                 resourceKind: "users",
                 ids,
                 initialPassword,
@@ -1031,7 +1031,7 @@ function ComparisonTable({
   actionLabel: string;
   updateActionLabel?: string;
   actionDisabled: boolean;
-  onCreateSelected: (ids: string[], initialPassword?: string) => void;
+  onCreateSelected: (ids: string[], initialPassword?: string) => unknown;
   onUpdateSelected?: (ids: string[]) => void;
   onRunSelected?: (actionIds: string[], deleteIds: string[]) => void;
   deleteActionLabel?: string;
@@ -1222,13 +1222,17 @@ function ComparisonTable({
     onUpdateSelected(selectedUpdateUserIds);
   };
 
-  const confirmInitialPassword = () => {
+  const confirmInitialPassword = async () => {
     const password = initialPassword.trim();
     if (!password) {
       toast.error("WORKS 초기 비밀번호를 입력해 주세요.");
       return;
     }
-    onCreateSelected(pendingInitialPasswordIds, password);
+    try {
+      await onCreateSelected(pendingInitialPasswordIds, password);
+    } catch {
+      return;
+    }
     setInitialPasswordOpen(false);
     setInitialPassword("");
     setPendingInitialPasswordIds([]);
@@ -1383,7 +1387,11 @@ function ComparisonTable({
                 >
                   취소
                 </Button>
-                <Button type="button" onClick={confirmInitialPassword}>
+                <Button
+                  type="button"
+                  onClick={confirmInitialPassword}
+                  disabled={actionDisabled}
+                >
                   생성 작업 등록
                 </Button>
               </DialogFooter>

adminfront/src/features/tenants/routes/tenantListView.ts

@@ -26,6 +26,14 @@ export function getTenantSearchMatchIds(
     .map((row) => row.id);
 }
 
+export function filterTenantViewRowsBySearch<T extends TenantViewRow>(
+  rows: T[],
+  search: string,
+) {
+  if (!search.trim()) return rows;
+  return rows.filter((row) => tenantMatchesListSearch(row, search));
+}
+
 function collectTenantTreeRows(
   nodes: TenantNode[],
   depth: number,

adminfront/src/features/tenants/utils/protectedTenants.test.ts

@@ -1,12 +1,25 @@
 import { describe, expect, it } from "vitest";
-import { getSeedTenantSlugs, isSeedTenant } from "./protectedTenants";
+import { getSeedTenantIds, isSeedTenant } from "./protectedTenants";
 
 describe("protectedTenants", () => {
-  it("marks tenants from seed-tenant.csv as protected", () => {
-    expect(getSeedTenantSlugs()).toEqual(
-      expect.arrayContaining(["hanmac-family", "personal"]),
+  it("marks tenants from seed-tenant.csv as protected by UUID", () => {
+    expect(getSeedTenantIds()).toEqual(
+      expect.arrayContaining([
+        "038326b6-954a-48a7-a85f-efd83f62b82a",
+        "5a03efd2-e62f-4243-800d-58334bf48b2f",
+        "9607eb7b-04d2-42ab-80fe-780fe21c7e8f",
+      ]),
     );
-    expect(isSeedTenant({ slug: "hanmac-family" })).toBe(true);
-    expect(isSeedTenant({ slug: "normal-tenant" })).toBe(false);
+    expect(
+      isSeedTenant({
+        id: "5a03efd2-e62f-4243-800d-58334bf48b2f",
+      }),
+    ).toBe(true);
+    expect(
+      isSeedTenant({
+        id: "5A03EFD2-E62F-4243-800D-58334BF48B2F",
+      }),
+    ).toBe(true);
+    expect(isSeedTenant({ id: "normal-tenant" })).toBe(false);
   });
 });

adminfront/src/features/tenants/utils/protectedTenants.ts

@@ -4,16 +4,15 @@ import seedTenantCSVRaw from "../../../../seed-tenant.csv?raw";
 import type { TenantSummary } from "../../../lib/adminApi";
 import { parseTenantCSV } from "./tenantCsvImport";
 
-const seedTenantSlugs = new Set(
-  parseTenantCSV(seedTenantCSVRaw)
-    .map((row) => row.slug.trim().toLowerCase())
-    .filter(Boolean),
+const seedTenants = parseTenantCSV(seedTenantCSVRaw);
+const seedTenantIds = new Set(
+  seedTenants.map((row) => row.tenantId.trim().toLowerCase()).filter(Boolean),
 );
 
-export function isSeedTenant(tenant: Pick<TenantSummary, "slug">): boolean {
-  return seedTenantSlugs.has(tenant.slug.trim().toLowerCase());
+export function isSeedTenant(tenant: Pick<TenantSummary, "id">): boolean {
+  return seedTenantIds.has(tenant.id.trim().toLowerCase());
 }
 
-export function getSeedTenantSlugs(): string[] {
-  return Array.from(seedTenantSlugs);
+export function getSeedTenantIds(): string[] {
+  return Array.from(seedTenantIds);
 }

adminfront/src/features/user-groups/routes/TenantUserGroupsTab.tsx

@@ -61,6 +61,7 @@ import {
 } from "../../../components/ui/table";
 import { toast } from "../../../components/ui/use-toast";
 import {
+  bulkUpdateUsers,
   exportTenantsCSV,
   exportUsersCSV,
   fetchAllTenants,
@@ -72,6 +73,10 @@ import {
 } from "../../../lib/adminApi";
 import { t } from "../../../lib/i18n";
 import { buildTenantFullTree, type TenantNode } from "../../../lib/tenantTree";
+import {
+  buildAuthenticatedOrgChartUserMultiPickerUrl,
+  parseOrgChartUserSelections,
+} from "../../users/orgChartPicker";
 
 // --- Icons & Helpers ---
 const getTenantIcon = (type?: string) => {
@@ -224,8 +229,10 @@ const MemberTable: React.FC<{
   const removeMutation = useMutation({
     mutationFn: (userId: string) =>
       updateUser(userId, { tenantSlug, isRemoveTenant: true }),
-    onSuccess: () => {
+    onSuccess: (_result, userId) => {
       queryClient.invalidateQueries({ queryKey: ["tenants-full-tree-v2"] });
+      queryClient.invalidateQueries({ queryKey: ["users"] });
+      queryClient.invalidateQueries({ queryKey: ["user", userId] });
       toast.success(t("msg.info.saved_success", "조직에서 제외되었습니다."));
       refetch();
     },
@@ -297,7 +304,12 @@ const MemberTable: React.FC<{
               <TableCell>
                 <DropdownMenu>
                   <DropdownMenuTrigger asChild>
-                    <Button variant="ghost" size="icon" className="h-8 w-8">
+                    <Button
+                      variant="ghost"
+                      size="icon"
+                      className="h-8 w-8"
+                      data-testid={`tenant-org-member-actions-${user.id}`}
+                    >
                       <MoreHorizontal size={14} />
                     </Button>
                   </DropdownMenuTrigger>
@@ -314,6 +326,7 @@ const MemberTable: React.FC<{
                       {t("ui.common.move_org", "타 조직으로 이동")}
                     </DropdownMenuItem>
                     <DropdownMenuItem
+                      data-testid={`tenant-org-member-remove-${user.id}`}
                       onClick={() => {
                         if (
                           window.confirm(
@@ -635,9 +648,11 @@ function TenantUserGroupsTab() {
 
               <div className="flex items-center gap-2">
                 <Button
+                  type="button"
                   variant="outline"
                   size="sm"
                   onClick={() => setIsUserAddOpen(true)}
+                  data-testid="tenant-org-member-add-open-btn"
                 >
                   <UserPlus size={16} className="mr-2" />
                   {t("ui.admin.users.list.add", "멤버 추가")}
@@ -869,8 +884,19 @@ const UserAddDialog: React.FC<{
   const [userSearch, setUserSearch] = useState("");
   const [isSearching, setIsSearching] = useState(false);
   const [searchResults, setSearchResults] = useState<UserSummary[]>([]);
-  const [selectedUserId, setSelectedUserId] = useState<string | null>(null);
+  const [queuedUsers, setQueuedUsers] = useState<UserSummary[]>([]);
   const [isSubmitting, setIsSubmitting] = useState(false);
+  const orgChartMemberPickerUrl = React.useMemo(
+    () =>
+      buildAuthenticatedOrgChartUserMultiPickerUrl(
+        import.meta.env.ORGFRONT_URL,
+      ),
+    [],
+  );
+  const queuedUserIds = React.useMemo(
+    () => new Set(queuedUsers.map((user) => user.id)),
+    [queuedUsers],
+  );
 
   const handleSearch = async () => {
     if (!userSearch) return;
@@ -886,12 +912,22 @@ const UserAddDialog: React.FC<{
   };
 
   const handleAssign = async () => {
-    if (!selectedUserId) return;
+    if (queuedUsers.length === 0) return;
     setIsSubmitting(true);
     try {
-      await updateUser(selectedUserId, { tenantSlug });
+      await bulkUpdateUsers({
+        userIds: queuedUsers.map((user) => user.id),
+        tenantSlug,
+        isAddTenant: true,
+      });
       queryClient.invalidateQueries({ queryKey: ["tenants-full-tree-v2"] });
-      toast.success(t("msg.info.saved_success", "사용자가 배정되었습니다."));
+      toast.success(
+        t(
+          "msg.admin.tenants.members.add_success",
+          "{{count}}명의 구성원이 추가되었습니다.",
+          { count: queuedUsers.length },
+        ),
+      );
       onOpenChange(false);
       resetFields();
     } catch (err) {
@@ -908,9 +944,54 @@ const UserAddDialog: React.FC<{
   const resetFields = () => {
     setUserSearch("");
     setSearchResults([]);
-    setSelectedUserId(null);
+    setQueuedUsers([]);
   };
 
+  const queueUsers = React.useCallback((users: UserSummary[]) => {
+    setQueuedUsers((current) => {
+      const blockedIds = new Set(current.map((user) => user.id));
+      const next = [...current];
+      for (const user of users) {
+        if (blockedIds.has(user.id)) continue;
+        blockedIds.add(user.id);
+        next.push(user);
+      }
+      return next;
+    });
+  }, []);
+
+  const queueUser = (user: UserSummary) => {
+    queueUsers([user]);
+  };
+
+  const removeQueuedUser = (userId: string) => {
+    setQueuedUsers((current) => current.filter((user) => user.id !== userId));
+  };
+
+  React.useEffect(() => {
+    if (!open) return;
+
+    const onMessage = (event: MessageEvent) => {
+      const selections = parseOrgChartUserSelections(event.data);
+      if (selections.length === 0) return;
+
+      queueUsers(
+        selections.map((selection) => ({
+          id: selection.id,
+          name: selection.name,
+          email: selection.email,
+          role: "user",
+          status: "active",
+          createdAt: "",
+          updatedAt: "",
+        })),
+      );
+    };
+
+    window.addEventListener("message", onMessage);
+    return () => window.removeEventListener("message", onMessage);
+  }, [open, queueUsers]);
+
   return (
     <Dialog
       open={open}
@@ -919,7 +1000,7 @@ const UserAddDialog: React.FC<{
         if (!v) resetFields();
       }}
     >
-      <DialogContent className="sm:max-w-[500px]">
+      <DialogContent className="max-w-5xl">
         <DialogHeader>
           <DialogTitle>
             {t("ui.admin.users.create.title", "멤버 추가")}
@@ -929,52 +1010,103 @@ const UserAddDialog: React.FC<{
           </DialogDescription>
         </DialogHeader>
 
-        <div className="space-y-4 py-4">
-          <div className="flex gap-2">
-            <Input
-              placeholder={t(
-                "ui.admin.users.list.search_placeholder",
-                "이메일 검색...",
-              )}
-              value={userSearch}
-              onChange={(e) => setUserSearch(e.target.value)}
-              onKeyDown={(e) => e.key === "Enter" && handleSearch()}
-            />
-            <Button
-              variant="secondary"
-              onClick={handleSearch}
-              disabled={isSearching}
-            >
-              <Search size={16} />
-            </Button>
-          </div>
-          <ScrollArea className="h-60 border rounded-md">
-            <Table>
-              <TableBody>
-                {searchResults?.map((user) => (
-                  <TableRow
-                    key={user.id}
-                    className={`cursor-pointer hover:bg-muted/50 ${selectedUserId === user.id ? "bg-primary/5" : ""}`}
-                    onClick={() => setSelectedUserId(user.id)}
-                  >
-                    <TableCell>
-                      <div className="flex items-center justify-between">
-                        <div>
-                          <p className="text-sm font-medium">{user.name}</p>
-                          <p className="text-[10px] text-muted-foreground">
-                            {user.email}
-                          </p>
+        <div className="grid gap-4 py-4 lg:grid-cols-[minmax(0,1fr)_minmax(360px,1.2fr)]">
+          <div className="space-y-3">
+            <div className="flex gap-2">
+              <Input
+                placeholder={t(
+                  "ui.admin.users.list.search_placeholder",
+                  "이메일 검색...",
+                )}
+                value={userSearch}
+                onChange={(e) => setUserSearch(e.target.value)}
+                onKeyDown={(e) => e.key === "Enter" && handleSearch()}
+                data-testid="tenant-org-member-search-input"
+              />
+              <Button
+                variant="secondary"
+                onClick={handleSearch}
+                disabled={isSearching}
+                data-testid="tenant-org-member-search-btn"
+              >
+                <Search size={16} />
+              </Button>
+            </div>
+            <ScrollArea className="h-60 rounded-md border">
+              <Table>
+                <TableBody>
+                  {searchResults?.map((user) => (
+                    <TableRow
+                      key={user.id}
+                      data-testid={`tenant-org-member-search-result-${user.id}`}
+                      className={`cursor-pointer hover:bg-muted/50 ${queuedUserIds.has(user.id) ? "bg-primary/5 opacity-60" : ""}`}
+                      onClick={() => queueUser(user)}
+                    >
+                      <TableCell>
+                        <div className="flex items-center justify-between">
+                          <div>
+                            <p className="text-sm font-medium">{user.name}</p>
+                            <p className="text-[10px] text-muted-foreground">
+                              {user.email}
+                            </p>
+                          </div>
+                          {queuedUserIds.has(user.id) && (
+                            <ChevronRight size={16} className="text-primary" />
+                          )}
                         </div>
-                        {selectedUserId === user.id && (
-                          <ChevronRight size={16} className="text-primary" />
-                        )}
-                      </div>
-                    </TableCell>
-                  </TableRow>
+                      </TableCell>
+                    </TableRow>
+                  ))}
+                </TableBody>
+              </Table>
+            </ScrollArea>
+          </div>
+          <div className="min-h-[360px] overflow-hidden rounded-md border">
+            <iframe
+              title={t(
+                "ui.admin.tenants.members.org_picker_title",
+                "조직도에서 구성원 선택",
+              )}
+              src={orgChartMemberPickerUrl}
+              className="h-[420px] w-full"
+              data-testid="tenant-org-member-picker-frame"
+            />
+          </div>
+          <div
+            className="min-h-16 rounded-md border bg-muted/20 p-3 lg:col-span-2"
+            data-testid="tenant-org-member-add-queue"
+          >
+            {queuedUsers.length === 0 ? (
+              <div className="flex h-10 items-center justify-center text-sm text-muted-foreground">
+                {t(
+                  "ui.admin.tenants.members.queue_empty",
+                  "추가할 구성원을 선택하세요.",
+                )}
+              </div>
+            ) : (
+              <div className="flex flex-wrap gap-2">
+                {queuedUsers.map((user) => (
+                  <span
+                    key={user.id}
+                    className="inline-flex max-w-full items-center gap-2 rounded-md border bg-background px-2 py-1 text-sm"
+                  >
+                    <span className="max-w-52 truncate">{user.name}</span>
+                    <button
+                      type="button"
+                      className="text-muted-foreground hover:text-foreground"
+                      onClick={() => removeQueuedUser(user.id)}
+                      aria-label={t(
+                        "ui.admin.tenants.members.queue_remove",
+                        "추가 명단에서 제거",
+                      )}
+                    >
+                      <Trash2 size={14} />
+                    </button>
+                  </span>
                 ))}
-              </TableBody>
-            </Table>
-          </ScrollArea>
+              </div>
+            )}
+          </div>
         </div>
         <DialogFooter>
           <Button variant="outline" onClick={() => onOpenChange(false)}>
@@ -982,7 +1114,8 @@ const UserAddDialog: React.FC<{
           </Button>
           <Button
             onClick={handleAssign}
-            disabled={isSubmitting || !selectedUserId}
+            disabled={isSubmitting || queuedUsers.length === 0}
+            data-testid="tenant-org-member-add-submit-btn"
           >
             {t("ui.common.add", "배정")}
           </Button>

adminfront/src/features/users/GlobalCustomClaimsPage.test.tsx

@@ -0,0 +1,96 @@
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import { fireEvent, render, screen, waitFor } from "@testing-library/react";
+import { MemoryRouter } from "react-router-dom";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { createI18nMock } from "../../test/i18nMock";
+import GlobalCustomClaimsPage from "./GlobalCustomClaimsPage";
+
+const fetchGlobalCustomClaimDefinitionsMock = vi.hoisted(() => vi.fn());
+const updateGlobalCustomClaimDefinitionsMock = vi.hoisted(() => vi.fn());
+
+vi.mock("../../lib/i18n", () => createI18nMock());
+
+vi.mock("../../lib/adminApi", () => ({
+  fetchGlobalCustomClaimDefinitions: fetchGlobalCustomClaimDefinitionsMock,
+  updateGlobalCustomClaimDefinitions: updateGlobalCustomClaimDefinitionsMock,
+}));
+
+vi.mock("../../components/ui/use-toast", () => ({
+  toast: {
+    success: vi.fn(),
+    error: vi.fn(),
+  },
+}));
+
+function renderGlobalCustomClaimsPage() {
+  const queryClient = new QueryClient({
+    defaultOptions: {
+      queries: { retry: false },
+      mutations: { retry: false },
+    },
+  });
+
+  return render(
+    <QueryClientProvider client={queryClient}>
+      <MemoryRouter>
+        <GlobalCustomClaimsPage />
+      </MemoryRouter>
+    </QueryClientProvider>,
+  );
+}
+
+describe("GlobalCustomClaimsPage", () => {
+  beforeEach(() => {
+    fetchGlobalCustomClaimDefinitionsMock.mockReset();
+    fetchGlobalCustomClaimDefinitionsMock.mockResolvedValue({
+      items: [
+        {
+          key: "locale",
+          label: "Locale",
+          valueType: "text",
+          readPermission: "admin_only",
+          writePermission: "admin_only",
+          description: "",
+        },
+      ],
+    });
+    updateGlobalCustomClaimDefinitionsMock.mockReset();
+    updateGlobalCustomClaimDefinitionsMock.mockResolvedValue({ items: [] });
+  });
+
+  it("forces user read permission on when user write permission is enabled", async () => {
+    renderGlobalCustomClaimsPage();
+
+    const readSelect = await screen.findByTestId(
+      "global-claim-definition-read-permission-locale",
+    );
+    const writeSelect = await screen.findByTestId(
+      "global-claim-definition-write-permission-locale",
+    );
+
+    expect(readSelect).toHaveValue("admin_only");
+    expect(writeSelect).toHaveValue("admin_only");
+
+    fireEvent.change(writeSelect, { target: { value: "user_and_admin" } });
+
+    await waitFor(() => {
+      expect(readSelect).toHaveValue("user_and_admin");
+      expect(writeSelect).toHaveValue("user_and_admin");
+    });
+
+    fireEvent.click(screen.getByRole("button", { name: /저장|Save/ }));
+
+    await waitFor(() => {
+      expect(updateGlobalCustomClaimDefinitionsMock).toHaveBeenCalled();
+    });
+    expect(updateGlobalCustomClaimDefinitionsMock.mock.calls[0][0]).toEqual({
+      items: [
+        expect.objectContaining({
+          key: "locale",
+          readPermission: "user_and_admin",
+          writePermission: "user_and_admin",
+        }),
+      ],
+    });
+  });
+});

adminfront/src/features/users/GlobalCustomClaimsPage.tsx

@@ -52,6 +52,7 @@ function toDrafts(items: GlobalCustomClaimDefinition[]): ClaimDraft[] {
 
 function toDefinitions(drafts: ClaimDraft[]): GlobalCustomClaimDefinition[] {
   return drafts
+    .map((draft) => normalizeClaimDraftPermissions(draft))
     .map((draft) => ({
       key: draft.key.trim(),
       label: draft.label.trim(),
@@ -63,6 +64,16 @@ function toDefinitions(drafts: ClaimDraft[]): GlobalCustomClaimDefinition[] {
     .filter((draft) => draft.key.length > 0);
 }
 
+function normalizeClaimDraftPermissions(draft: ClaimDraft): ClaimDraft {
+  if (draft.writePermission !== "user_and_admin") {
+    return draft;
+  }
+  return {
+    ...draft,
+    readPermission: "user_and_admin",
+  };
+}
+
 function permissionLabel(permission: GlobalCustomClaimPermission) {
   return permission === "user_and_admin"
     ? t(
@@ -116,7 +127,9 @@ export default function GlobalCustomClaimsPage() {
   const updateClaim = (id: string, patch: Partial<ClaimDraft>) => {
     setDrafts((current) =>
       current.map((draft) =>
-        draft.id === id ? { ...draft, ...patch } : draft,
+        draft.id === id
+          ? normalizeClaimDraftPermissions({ ...draft, ...patch })
+          : draft,
       ),
     );
   };
@@ -140,7 +153,7 @@ export default function GlobalCustomClaimsPage() {
         )}
         description={t(
           "msg.admin.users.global_custom_claims.description",
-          "모든 RP에 공통 적용할 사용자 claim 정의와 읽기/쓰기 권한 기본값을 관리합니다.",
+          "모든 RP에 공통 적용할 사용자 claim 정의와 사용자의 읽기/쓰기 권한 기본값을 관리합니다. 쓰기 허용 시 읽기도 자동으로 허용됩니다.",
         )}
         actions={
           <>
@@ -185,7 +198,7 @@ export default function GlobalCustomClaimsPage() {
           <CardDescription>
             {t(
               "msg.admin.users.global_custom_claims.registry",
-              "정의된 claim key만 사용자 상세의 전역 claim 값 관리 대상이 됩니다.",
+              "정의된 claim key만 사용자 상세의 전역 claim 값 관리 대상이 됩니다. 읽기/쓰기는 관리자 권한이 아니라 사용자가 본인 claim 값을 조회하거나 수정할 수 있는지에 대한 설정입니다.",
             )}
           </CardDescription>
         </CardHeader>

adminfront/src/features/users/UserDetailPage.employeeNumber.test.tsx

@@ -7,27 +7,14 @@ import UserDetailPage from "./UserDetailPage";
 
 const updateUserMock = vi.hoisted(() => vi.fn());
 const profileRoleMock = vi.hoisted(() => ({ role: "super_admin" }));
+const fetchAllTenantsMock = vi.hoisted(() => vi.fn());
+const fetchUserMock = vi.hoisted(() => vi.fn());
 
 vi.mock("../../lib/i18n", () => createI18nMock());
 
 vi.mock("../../lib/adminApi", () => ({
   deleteUser: vi.fn(),
-  fetchAllTenants: vi.fn(async () => ({
-    items: [
-      {
-        id: "tenant-hanmac",
-        type: "COMPANY",
-        name: "한맥기술",
-        slug: "hanmac",
-        description: "",
-        status: "active",
-        memberCount: 1,
-        createdAt: "2026-06-01T00:00:00Z",
-        updatedAt: "2026-06-01T00:00:00Z",
-      },
-    ],
-    total: 1,
-  })),
+  fetchAllTenants: fetchAllTenantsMock,
   fetchMe: vi.fn(async () => ({
     id: "admin-user",
     role: profileRoleMock.role,
@@ -48,42 +35,7 @@ vi.mock("../../lib/adminApi", () => ({
   })),
   fetchPasswordPolicy: vi.fn(async () => ({ minLength: 12 })),
   fetchTenant: vi.fn(),
-  fetchUser: vi.fn(async () => ({
-    id: "user-1",
-    email: "user@example.com",
-    name: "사용자",
-    phone: "01012345678",
-    role: "user",
-    status: "active",
-    tenantSlug: "hanmac",
-    tenant: {
-      id: "tenant-hanmac",
-      type: "COMPANY",
-      name: "한맥기술",
-      slug: "hanmac",
-      description: "",
-      status: "active",
-      memberCount: 1,
-      createdAt: "2026-06-01T00:00:00Z",
-      updatedAt: "2026-06-01T00:00:00Z",
-    },
-    joinedTenants: [],
-    metadata: {
-      employee_id: {
-        "0": "h",
-        "1": "j",
-        "2": "k",
-        "3": "w",
-        "4": "o",
-        "5": "n",
-      },
-      global_custom_claims: {
-        contract_date: "2026-06-09",
-      },
-    },
-    createdAt: "2026-06-01T00:00:00Z",
-    updatedAt: "2026-06-01T00:00:00Z",
-  })),
+  fetchUser: fetchUserMock,
   fetchUserRpHistory: vi.fn(async () => []),
   updateUser: updateUserMock,
 }));
@@ -108,6 +60,60 @@ describe("UserDetailPage Worksmobile employee number", () => {
   beforeEach(() => {
     updateUserMock.mockReset();
     updateUserMock.mockResolvedValue({});
+    fetchAllTenantsMock.mockReset();
+    fetchAllTenantsMock.mockResolvedValue({
+      items: [
+        {
+          id: "tenant-hanmac",
+          type: "COMPANY",
+          name: "한맥기술",
+          slug: "hanmac",
+          description: "",
+          status: "active",
+          memberCount: 1,
+          createdAt: "2026-06-01T00:00:00Z",
+          updatedAt: "2026-06-01T00:00:00Z",
+        },
+      ],
+      total: 1,
+    });
+    fetchUserMock.mockReset();
+    fetchUserMock.mockResolvedValue({
+      id: "user-1",
+      email: "user@example.com",
+      name: "사용자",
+      phone: "01012345678",
+      role: "user",
+      status: "active",
+      tenantSlug: "hanmac",
+      tenant: {
+        id: "tenant-hanmac",
+        type: "COMPANY",
+        name: "한맥기술",
+        slug: "hanmac",
+        description: "",
+        status: "active",
+        memberCount: 1,
+        createdAt: "2026-06-01T00:00:00Z",
+        updatedAt: "2026-06-01T00:00:00Z",
+      },
+      joinedTenants: [],
+      metadata: {
+        employee_id: {
+          "0": "h",
+          "1": "j",
+          "2": "k",
+          "3": "w",
+          "4": "o",
+          "5": "n",
+        },
+        global_custom_claims: {
+          contract_date: "2026-06-09",
+        },
+      },
+      createdAt: "2026-06-01T00:00:00Z",
+      updatedAt: "2026-06-01T00:00:00Z",
+    });
     profileRoleMock.role = "super_admin";
   });
 
@@ -168,6 +174,111 @@ describe("UserDetailPage Worksmobile employee number", () => {
     expect(payload.metadata).not.toHaveProperty("employee_id");
   });
 
+  it("shows non-private appointment tenants from metadata and hides private tenants", async () => {
+    fetchAllTenantsMock.mockResolvedValue({
+      items: [
+        {
+          id: "tenant-hanmac",
+          type: "COMPANY",
+          name: "한맥기술",
+          slug: "hanmac",
+          description: "",
+          status: "active",
+          memberCount: 1,
+          createdAt: "2026-06-01T00:00:00Z",
+          updatedAt: "2026-06-01T00:00:00Z",
+        },
+        {
+          id: "tenant-public",
+          type: "USER_GROUP",
+          name: "공개 TF",
+          slug: "public-tf",
+          description: "",
+          status: "active",
+          config: { visibility: "public" },
+          memberCount: 1,
+          createdAt: "2026-06-01T00:00:00Z",
+          updatedAt: "2026-06-01T00:00:00Z",
+        },
+        {
+          id: "tenant-internal",
+          type: "USER_GROUP",
+          name: "내부 조직",
+          slug: "internal-team",
+          description: "",
+          status: "active",
+          config: { visibility: "internal" },
+          memberCount: 1,
+          createdAt: "2026-06-01T00:00:00Z",
+          updatedAt: "2026-06-01T00:00:00Z",
+        },
+        {
+          id: "tenant-private",
+          type: "USER_GROUP",
+          name: "비공개 조직",
+          slug: "private-team",
+          description: "",
+          status: "active",
+          config: { visibility: "private" },
+          memberCount: 1,
+          createdAt: "2026-06-01T00:00:00Z",
+          updatedAt: "2026-06-01T00:00:00Z",
+        },
+      ],
+      total: 4,
+    });
+    fetchUserMock.mockResolvedValue({
+      id: "user-1",
+      email: "user@example.com",
+      name: "사용자",
+      phone: "01012345678",
+      role: "user",
+      status: "active",
+      tenantSlug: "hanmac",
+      tenant: {
+        id: "tenant-hanmac",
+        type: "COMPANY",
+        name: "한맥기술",
+        slug: "hanmac",
+        description: "",
+        status: "active",
+        memberCount: 1,
+        createdAt: "2026-06-01T00:00:00Z",
+        updatedAt: "2026-06-01T00:00:00Z",
+      },
+      joinedTenants: [],
+      metadata: {
+        additionalAppointments: [
+          {
+            tenantId: "tenant-public",
+            tenantSlug: "public-tf",
+            tenantName: "공개 TF",
+          },
+          {
+            tenantId: "tenant-internal",
+            tenantSlug: "internal-team",
+            tenantName: "내부 조직",
+          },
+          {
+            tenantId: "tenant-private",
+            tenantSlug: "private-team",
+            tenantName: "비공개 조직",
+          },
+        ],
+      },
+      createdAt: "2026-06-01T00:00:00Z",
+      updatedAt: "2026-06-01T00:00:00Z",
+    });
+
+    renderUserDetailPage();
+
+    fireEvent.click(await screen.findByRole("tab", { name: /테넌트 프로필/ }));
+
+    expect(await screen.findByText("공개 TF")).toBeInTheDocument();
+    expect(screen.getByText("내부 조직")).toBeInTheDocument();
+    expect(screen.queryByText("비공개 조직")).not.toBeInTheDocument();
+  });
+
   it("only allows editing per-user values for globally defined custom claims", async () => {
     renderUserDetailPage();
 
@@ -208,4 +319,79 @@ describe("UserDetailPage Worksmobile employee number", () => {
       }),
     );
   });
+
+  it("preserves per-user global custom claim permissions instead of overwriting them from definitions", async () => {
+    fetchUserMock.mockResolvedValueOnce({
+      id: "user-1",
+      email: "user@example.com",
+      name: "사용자",
+      phone: "01012345678",
+      role: "user",
+      status: "active",
+      tenantSlug: "hanmac",
+      tenant: {
+        id: "tenant-hanmac",
+        type: "COMPANY",
+        name: "한맥기술",
+        slug: "hanmac",
+        description: "",
+        status: "active",
+        memberCount: 1,
+        createdAt: "2026-06-01T00:00:00Z",
+        updatedAt: "2026-06-01T00:00:00Z",
+      },
+      joinedTenants: [],
+      metadata: {
+        global_custom_claims: {
+          contract_date: "2026-06-09",
+        },
+        global_custom_claim_types: {
+          contract_date: "date",
+        },
+        global_custom_claim_permissions: {
+          contract_date: {
+            readPermission: "user_and_admin",
+            writePermission: "user_and_admin",
+          },
+        },
+      },
+      createdAt: "2026-06-01T00:00:00Z",
+      updatedAt: "2026-06-01T00:00:00Z",
+    });
+
+    renderUserDetailPage();
+
+    const tab = await screen.findByTestId("global-custom-claim-tab");
+    fireEvent.click(tab);
+    const valueInput = await screen.findByTestId(
+      "global-custom-claim-value-contract_date",
+    );
+
+    expect(screen.getAllByText("사용자 및 관리자 가능").length).toBeGreaterThan(
+      0,
+    );
+
+    fireEvent.change(valueInput, { target: { value: "2026-07-01" } });
+    fireEvent.click(
+      screen.getByRole("button", { name: /사용자 Claim 값 저장/ }),
+    );
+
+    await waitFor(() => expect(updateUserMock).toHaveBeenCalled());
+    expect(updateUserMock).toHaveBeenCalledWith(
+      "user-1",
+      expect.objectContaining({
+        metadata: expect.objectContaining({
+          global_custom_claims: expect.objectContaining({
+            contract_date: "2026-07-01",
+          }),
+          global_custom_claim_permissions: expect.objectContaining({
+            contract_date: {
+              readPermission: "user_and_admin",
+              writePermission: "user_and_admin",
+            },
+          }),
+        }),
+      }),
+    );
+  });
 });

adminfront/src/features/users/UserDetailPage.tsx

@@ -141,6 +141,15 @@ function isMetadataRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
+function normalizeCustomClaimPermission(
+  value: unknown,
+  fallback: CustomClaimPermission,
+): CustomClaimPermission {
+  return value === "admin_only" || value === "user_and_admin"
+    ? value
+    : fallback;
+}
+
 function cleanMetadataValue(value: unknown): unknown {
   if (Array.isArray(value)) {
     return value
@@ -209,9 +218,18 @@ function createGlobalCustomClaimRows(
   const rawClaims = isMetadataRecord(metadata.global_custom_claims)
     ? metadata.global_custom_claims
     : {};
+  const rawPermissions = isMetadataRecord(
+    metadata.global_custom_claim_permissions,
+  )
+    ? metadata.global_custom_claim_permissions
+    : {};
 
   return definitions.map((definition, index) => {
     const value = rawClaims[definition.key];
+    const rawPermission = rawPermissions[definition.key];
+    const permission: Record<string, unknown> = isMetadataRecord(rawPermission)
+      ? rawPermission
+      : {};
     return {
       id: `${definition.key}-${index}`,
       key: definition.key,
@@ -224,8 +242,14 @@ function createGlobalCustomClaimRows(
             ? ""
             : JSON.stringify(value),
       valueType: definition.valueType,
-      readPermission: definition.readPermission,
-      writePermission: definition.writePermission,
+      readPermission: normalizeCustomClaimPermission(
+        permission.readPermission,
+        definition.readPermission,
+      ),
+      writePermission: normalizeCustomClaimPermission(
+        permission.writePermission,
+        definition.writePermission,
+      ),
     };
   });
 }
@@ -291,6 +315,48 @@ async function resolveTenantSelection(
   };
 }
 
+function getTenantVisibility(tenant?: TenantSummary) {
+  const value = tenant?.config?.visibility;
+  return typeof value === "string" ? value.trim().toLowerCase() : "public";
+}
+
+function isPrivateTenant(tenant?: TenantSummary) {
+  return getTenantVisibility(tenant) === "private";
+}
+
+function appointmentTenantsFromMetadata(
+  metadata: Record<string, unknown> | undefined,
+  tenants: TenantSummary[],
+) {
+  const rawAppointments = metadata?.additionalAppointments;
+  if (!Array.isArray(rawAppointments)) {
+    return [];
+  }
+
+  return rawAppointments
+    .map((raw) => {
+      if (!raw || typeof raw !== "object") {
+        return null;
+      }
+      const appointment = raw as Record<string, unknown>;
+      const tenantId =
+        typeof appointment.tenantId === "string" ? appointment.tenantId : "";
+      const tenantSlug =
+        typeof appointment.tenantSlug === "string"
+          ? appointment.tenantSlug
+          : typeof appointment.slug === "string"
+            ? appointment.slug
+            : "";
+      return tenants.find(
+        (tenant) =>
+          (tenantId && tenant.id === tenantId) ||
+          (tenantSlug && tenant.slug === tenantSlug),
+      );
+    })
+    .filter((tenant): tenant is TenantSummary => Boolean(tenant))
+    .filter((tenant) => !isPrivateTenant(tenant));
+}
+
 function createEmptyAppointment(): AppointmentDraft {
   return {
     draftId: createDraftId(),
@@ -385,8 +451,6 @@ function TenantMetadataFields({
   register: UseFormRegister<UserFormValues>;
   errors: FieldErrors<UserFormValues>;
 }) {
-  if (schema.length === 0) return null;
-
   return (
     <div className="rounded-xl border border-border bg-card overflow-hidden shadow-sm">
       <div className="bg-muted/30 px-5 py-3 border-b border-border flex items-center justify-between">
@@ -401,74 +465,85 @@ function TenantMetadataFields({
         </span>
       </div>
       <div className="p-6 grid gap-6 md:grid-cols-2">
-        {schema.map((field) => (
-          <div key={field.key} className="space-y-2">
-            <Label
-              htmlFor={`metadata.${tenant.id}.${field.key}`}
-              className="text-xs font-semibold text-muted-foreground flex items-center gap-1"
-            >
-              {field.label}
-              {field.required && <span className="text-destructive">*</span>}
-              {field.adminOnly && (
-                <span className="ml-2 text-[9px] bg-blue-500/10 text-blue-500 px-1.5 py-0.5 rounded uppercase font-bold">
-                  Admin Only
-                </span>
-              )}
-              {field.isLoginId && (
-                <span className="ml-2 text-[9px] bg-green-500/10 text-green-600 px-1.5 py-0.5 rounded uppercase font-bold">
-                  {t("ui.admin.users.detail.form.is_login_id", "로그인 ID")}
-                </span>
-              )}
-            </Label>
-            <Input
-              id={`metadata.${tenant.id}.${field.key}`}
-              type={
-                field.type === "number"
-                  ? "number"
-                  : field.type === "date"
-                    ? "date"
-                    : field.type === "boolean"
-                      ? "checkbox"
-                      : "text"
-              }
-              className={field.type === "boolean" ? "w-5 h-5" : "h-10 text-sm"}
-              {...register(`metadata.${tenant.id}.${field.key}` as const, {
-                required: field.required
-                  ? t(
-                      "msg.admin.users.detail.form.field_required",
-                      "필수입니다.",
-                    )
-                  : false,
-                pattern: field.validation
-                  ? {
-                      value: new RegExp(field.validation),
-                      message: t(
-                        "msg.admin.users.detail.form.invalid_format",
-                        "형식이 올바르지 않습니다.",
-                      ),
-                    }
-                  : undefined,
-              })}
-            />
-            {(
-              errors.metadata as unknown as Record<
-                string,
-                Record<string, { message?: string }>
-              >
-            )?.[tenant.id]?.[field.key] && (
-              <p className="text-[10px] text-destructive font-medium">
-                {
-                  (
-                    errors.metadata as unknown as Record<
-                      string,
-                      Record<string, { message?: string }>
-                    >
-                  )?.[tenant.id]?.[field.key]?.message
-                }
-              </p>
+        {schema.length === 0 ? (
+          <p className="text-sm text-muted-foreground md:col-span-2">
+            {t(
+              "msg.admin.users.detail.tenant_schema_empty",
+              "이 테넌트에 설정된 프로필 필드가 없습니다.",
             )}
-          </div>
-        ))}
+          </p>
+        ) : (
+          schema.map((field) => (
+            <div key={field.key} className="space-y-2">
+              <Label
+                htmlFor={`metadata.${tenant.id}.${field.key}`}
+                className="text-xs font-semibold text-muted-foreground flex items-center gap-1"
+              >
+                {field.label}
+                {field.required && <span className="text-destructive">*</span>}
+                {field.adminOnly && (
+                  <span className="ml-2 text-[9px] bg-blue-500/10 text-blue-500 px-1.5 py-0.5 rounded uppercase font-bold">
+                    Admin Only
+                  </span>
+                )}
+                {field.isLoginId && (
+                  <span className="ml-2 text-[9px] bg-green-500/10 text-green-600 px-1.5 py-0.5 rounded uppercase font-bold">
+                    {t("ui.admin.users.detail.form.is_login_id", "로그인 ID")}
+                  </span>
+                )}
+              </Label>
+              <Input
+                id={`metadata.${tenant.id}.${field.key}`}
+                type={
+                  field.type === "number"
+                    ? "number"
+                    : field.type === "date"
+                      ? "date"
+                      : field.type === "boolean"
+                        ? "checkbox"
+                        : "text"
+                }
+                className={
+                  field.type === "boolean" ? "w-5 h-5" : "h-10 text-sm"
+                }
+                {...register(`metadata.${tenant.id}.${field.key}` as const, {
+                  required: field.required
+                    ? t(
+                        "msg.admin.users.detail.form.field_required",
+                        "필수입니다.",
+                      )
+                    : false,
+                  pattern: field.validation
+                    ? {
+                        value: new RegExp(field.validation),
+                        message: t(
+                          "msg.admin.users.detail.form.invalid_format",
+                          "형식이 올바르지 않습니다.",
+                        ),
+                      }
+                    : undefined,
+                })}
+              />
+              {(
+                errors.metadata as unknown as Record<
+                  string,
+                  Record<string, { message?: string }>
+                >
+              )?.[tenant.id]?.[field.key] && (
+                <p className="text-[10px] text-destructive font-medium">
+                  {
+                    (
+                      errors.metadata as unknown as Record<
+                        string,
+                        Record<string, { message?: string }>
+                      >
+                    )?.[tenant.id]?.[field.key]?.message
+                  }
+                </p>
+              )}
+            </div>
+          ))
+        )}
       </div>
     </div>
   );
@@ -1103,12 +1178,30 @@ function UserDetailPage() {
   const userAffiliatedTenants = React.useMemo(() => {
     const joined = user?.joinedTenants || [];
     const primary = user?.tenant;
-    const all = [...joined];
-    if (primary && !joined.some((t) => t.id === primary.id)) {
+    const appointmentTenants = appointmentTenantsFromMetadata(
+      user?.metadata as Record<string, unknown> | undefined,
+      tenants,
+    );
+    const all = joined.filter((tenant) => {
+      const fullTenant = tenants.find((item) => item.id === tenant.id);
+      return !isPrivateTenant(fullTenant ?? tenant);
+    });
+    if (
+      primary &&
+      !isPrivateTenant(
+        tenants.find((tenant) => tenant.id === primary.id) ?? primary,
+      ) &&
+      !all.some((t) => t.id === primary.id)
+    ) {
       all.unshift(primary);
     }
+    for (const tenant of appointmentTenants) {
+      if (!all.some((item) => item.id === tenant.id)) {
+        all.push(tenant);
+      }
+    }
     return all;
-  }, [user?.joinedTenants, user?.tenant]);
+  }, [tenants, user?.joinedTenants, user?.metadata, user?.tenant]);
   const selectableRepresentativeTenants = React.useMemo(
     () =>
       filterNonHanmacFamilyTenants(userAffiliatedTenants, hanmacFamilyTenantId),
@@ -1962,7 +2055,7 @@ function UserDetailPage() {
                     <CardDescription>
                       {t(
                         "msg.admin.users.detail.custom_claims.description",
-                        "전역으로 정의된 custom claim의 이 사용자 값을 관리합니다. Claim 정의 추가와 타입 변경은 전역 설정 화면에서만 가능합니다.",
+                        "전역으로 정의된 custom claim의 이 사용자 값을 관리합니다. 읽기/쓰기 표시는 사용자가 본인 claim 값을 조회하거나 직접 수정할 수 있는지에 대한 권한이며, claim 정의 추가와 타입 변경은 전역 설정 화면에서만 가능합니다.",
                       )}
                     </CardDescription>
                   </div>

adminfront/src/features/users/UserListPage.render.test.tsx

@@ -22,6 +22,7 @@ const users = Array.from({ length: 200 }, (_, index) => ({
 }));
 
 const fetchUsersMock = vi.hoisted(() => vi.fn());
+const fetchAllTenantsMock = vi.hoisted(() => vi.fn());
 const searchRenderBudgetMs =
   process.env.npm_lifecycle_event === "test:coverage" ? 500 : 300;
 
@@ -34,10 +35,7 @@ vi.mock("../../lib/adminApi", () => ({
     name: "Admin",
     email: "admin@example.com",
   })),
-  fetchAllTenants: vi.fn(async () => ({
-    items: [{ id: "tenant-1", name: "한맥", slug: "hanmac" }],
-    total: 1,
-  })),
+  fetchAllTenants: fetchAllTenantsMock,
   fetchTenant: vi.fn(async () => ({
     id: "tenant-1",
     name: "한맥",
@@ -108,6 +106,11 @@ describe("UserListPage search rendering", () => {
   beforeEach(() => {
     selectRenderCounter.count = 0;
     fetchUsersMock.mockReset();
+    fetchAllTenantsMock.mockReset();
+    fetchAllTenantsMock.mockResolvedValue({
+      items: [{ id: "tenant-1", name: "한맥", slug: "hanmac" }],
+      total: 1,
+    });
     fetchUsersMock.mockImplementation(
       async (_limit: number, _offset: number, search?: string) => {
         const normalizedSearch = search?.trim().toLowerCase();
@@ -157,7 +160,7 @@ describe("UserListPage search rendering", () => {
     expect(content).toHaveClass("flex", "h-full", "items-center");
   });
 
-  it("renders additional tenant appointments in the tenant column", async () => {
+  it("does not render private additional tenant appointments in the tenant column", async () => {
     fetchUsersMock.mockResolvedValueOnce({
       items: [
         {
@@ -183,7 +186,63 @@ describe("UserListPage search rendering", () => {
     expect(
       await screen.findByText("Additional Tenant User"),
     ).toBeInTheDocument();
-    expect(screen.getByText("비공개 팀")).toBeInTheDocument();
+    expect(screen.getAllByText("한맥").length).toBeGreaterThanOrEqual(1);
+    expect(screen.queryByText("비공개 팀")).not.toBeInTheDocument();
+  });
+
+  it("excludes private tenants when choosing the representative tenant for the user list", async () => {
+    fetchAllTenantsMock.mockResolvedValueOnce({
+      items: [
+        {
+          id: "tenant-private",
+          name: "비공개 팀",
+          slug: "private-team",
+          config: { visibility: "private" },
+        },
+        {
+          id: "tenant-public",
+          name: "공개 팀",
+          slug: "public-team",
+          config: { visibility: "public" },
+        },
+      ],
+      total: 2,
+    });
+    fetchUsersMock.mockResolvedValueOnce({
+      items: [
+        {
+          ...users[0],
+          name: "Private Primary User",
+          tenantSlug: "private-team",
+          tenant: {
+            id: "tenant-private",
+            name: "비공개 팀",
+            slug: "private-team",
+            config: { visibility: "private" },
+          },
+          joinedTenants: [
+            {
+              id: "tenant-public",
+              name: "공개 팀",
+              slug: "public-team",
+              config: { visibility: "public" },
+            },
+          ],
+          metadata: {
+            primaryTenantId: "tenant-private",
+            primaryTenantSlug: "private-team",
+            primaryTenantName: "비공개 팀",
+          },
+        },
+      ],
+      total: 1,
+    });
+
+    renderUserListPage();
+
+    expect(await screen.findByText("Private Primary User")).toBeInTheDocument();
+    expect(screen.getByText("공개 팀")).toBeInTheDocument();
+    expect(screen.queryByText("비공개 팀")).not.toBeInTheDocument();
   });
 
   it("centers the initial loading message across the user table", async () => {

adminfront/src/features/users/UserListPage.tsx

@@ -151,50 +151,111 @@ function assignableSystemRoleValue(role?: string | null) {
   return isSuperAdminRole(role) ? "super_admin" : "user";
 }
 
-function collectAdditionalTenantLabels(user: UserSummary) {
-  const primaryKeys = new Set(
-    [user.tenant?.id, user.tenant?.slug, user.tenantSlug]
-      .filter((value): value is string => Boolean(value))
-      .map((value) => value.toLowerCase()),
+type RepresentativeTenantCandidate = {
+  id?: string;
+  slug?: string;
+  name?: string;
+  config?: Record<string, unknown>;
+};
+
+function stringValue(value: unknown) {
+  return typeof value === "string" ? value.trim() : "";
+}
+
+function tenantVisibility(tenant?: RepresentativeTenantCandidate) {
+  const visibility = tenant?.config?.visibility;
+  return typeof visibility === "string" ? visibility.trim() : "";
+}
+
+function findTenantCandidate(
+  candidate: RepresentativeTenantCandidate,
+  tenants: TenantSummary[],
+) {
+  const id = candidate.id?.toLowerCase() ?? "";
+  const slug = candidate.slug?.toLowerCase() ?? "";
+  if (!id && !slug) return undefined;
+  return tenants.find(
+    (tenant) =>
+      (id && tenant.id.toLowerCase() === id) ||
+      (slug && tenant.slug.toLowerCase() === slug),
   );
-  const labels: string[] = [];
-  const seen = new Set<string>();
-  const addLabel = (
-    tenantId?: unknown,
-    tenantSlug?: unknown,
-    tenantName?: unknown,
-  ) => {
-    const id = typeof tenantId === "string" ? tenantId.trim() : "";
-    const slug = typeof tenantSlug === "string" ? tenantSlug.trim() : "";
-    const name = typeof tenantName === "string" ? tenantName.trim() : "";
-    const key = (id || slug || name).toLowerCase();
-    if (!key || primaryKeys.has(key) || seen.has(key)) {
-      return;
-    }
-    seen.add(key);
-    labels.push(name || slug || id);
-  };
+}
+
+function isPrivateTenantCandidate(
+  candidate: RepresentativeTenantCandidate,
+  tenants: TenantSummary[],
+) {
+  const tenant = findTenantCandidate(candidate, tenants) ?? candidate;
+  return tenantVisibility(tenant) === "private";
+}
+
+function candidateLabel(candidate: RepresentativeTenantCandidate) {
+  return candidate.name || candidate.slug || candidate.id || "";
+}
+
+function metadataTenantCandidate(
+  metadata: Record<string, unknown> | undefined,
+): RepresentativeTenantCandidate | null {
+  const id = stringValue(metadata?.primaryTenantId);
+  const slug = stringValue(metadata?.primaryTenantSlug);
+  const name = stringValue(metadata?.primaryTenantName);
+  if (!id && !slug && !name) return null;
+  return { id, slug, name };
+}
+
+function appointmentTenantCandidate(
+  appointment: unknown,
+): RepresentativeTenantCandidate | null {
+  if (!appointment || typeof appointment !== "object") return null;
+  const value = appointment as Record<string, unknown>;
+  const id = stringValue(value.tenantId);
+  const slug = stringValue(value.tenantSlug ?? value.slug);
+  const name = stringValue(value.tenantName ?? value.name);
+  if (!id && !slug && !name) return null;
+  return { id, slug, name };
+}
+
+function resolveRepresentativeTenantLabel(
+  user: UserSummary,
+  tenants: TenantSummary[],
+) {
+  const candidates: RepresentativeTenantCandidate[] = [];
+  const knownTenants = [
+    ...(user.tenant ? [user.tenant] : []),
+    ...(user.joinedTenants ?? []),
+    ...tenants,
+  ];
+  const primaryFromMetadata = metadataTenantCandidate(user.metadata);
+  if (primaryFromMetadata) candidates.push(primaryFromMetadata);
+  if (user.tenant) candidates.push(user.tenant);
 
   for (const tenant of user.joinedTenants ?? []) {
-    addLabel(tenant.id, tenant.slug, tenant.name);
+    candidates.push(tenant);
   }
 
   const appointments = user.metadata?.additionalAppointments;
   if (Array.isArray(appointments)) {
     for (const appointment of appointments) {
-      if (!appointment || typeof appointment !== "object") {
+      if (
+        appointment &&
+        typeof appointment === "object" &&
+        (appointment as Record<string, unknown>).isPrimary !== true
+      ) {
         continue;
       }
-      const value = appointment as Record<string, unknown>;
-      addLabel(
-        value.tenantId,
-        value.tenantSlug ?? value.slug,
-        value.tenantName ?? value.name,
-      );
+      const candidate = appointmentTenantCandidate(appointment);
+      if (candidate) candidates.push(candidate);
     }
   }
+  if (user.tenantSlug) candidates.push({ slug: user.tenantSlug });
 
-  return labels;
+  const representative = candidates.find(
+    (candidate) =>
+      candidateLabel(candidate) &&
+      !isPrivateTenantCandidate(candidate, knownTenants),
+  );
+
+  return candidateLabel(representative ?? {});
 }
 
 function normalizeUserTableRect(rect: Rect, fallbackWidth: number): Rect {
@@ -468,10 +529,10 @@ function UserListPage() {
           name_email: (user) =>
             `${user.name ?? ""} ${user.email ?? ""} ${user.phone ?? ""}`,
           tenant_dept: (user) =>
-            `${user.tenant?.name ?? user.tenantSlug ?? ""} ${collectAdditionalTenantLabels(user).join(" ")} ${user.department ?? ""}`,
+            `${resolveRepresentativeTenantLabel(user, tenants)} ${user.department ?? ""}`,
         },
       ),
-    [userSchema],
+    [tenants, userSchema],
   );
   const items = React.useMemo(() => {
     if (!sortConfig) {
@@ -1028,8 +1089,9 @@ function UserListPage() {
                     virtualRows.map((virtualRow) => {
                       const user = items[virtualRow.index];
                       if (!user) return null;
-                      const additionalTenantLabels =
-                        collectAdditionalTenantLabels(user);
+                      const representativeTenantLabel =
+                        resolveRepresentativeTenantLabel(user, tenants) ||
+                        t("ui.common.unassigned", "미배정");
 
                       return (
                         <TableRow
@@ -1161,27 +1223,13 @@ function UserListPage() {
                           <TableCell>
                             <div className="flex flex-col gap-1">
                               <span className="text-sm font-medium">
-                                {user.tenant?.name ||
-                                  user.tenantSlug ||
-                                  t("ui.common.unassigned", "미배정")}
+                                {representativeTenantLabel}
                               </span>
                               {user.department && (
                                 <span className="text-xs text-muted-foreground">
                                   {user.department}
                                 </span>
                               )}
-                              {additionalTenantLabels.length > 0 && (
-                                <div className="flex flex-wrap gap-1">
-                                  {additionalTenantLabels.map((label) => (
-                                    <span
-                                      key={label}
-                                      className="max-w-40 truncate rounded border bg-muted/40 px-1.5 py-0.5 text-xs text-muted-foreground"
-                                    >
-                                      {label}
-                                    </span>
-                                  ))}
-                                </div>
-                              )}
                             </div>
                           </TableCell>
                           {/* Dynamic Metadata Cells */}

adminfront/src/features/users/orgChartPicker.test.ts

@@ -2,11 +2,13 @@ import { describe, expect, it } from "vitest";
 import {
   buildAuthenticatedOrgChartTenantPickerUrl,
   buildAuthenticatedOrgChartUrl,
+  buildAuthenticatedOrgChartUserMultiPickerUrl,
   buildOrgChartTenantPickerUrl,
   filterNonHanmacFamilyTenants,
   getTenantGradeOptions,
   isHanmacFamilyUser,
   parseOrgChartTenantSelection,
+  parseOrgChartUserSelections,
 } from "./orgChartPicker";
 
 describe("orgChartPicker", () => {
@@ -49,6 +51,16 @@ describe("orgChartPicker", () => {
     );
   });
 
+  it("builds an authenticated multi picker URL for tenant member selection", () => {
+    expect(
+      buildAuthenticatedOrgChartUserMultiPickerUrl(
+        "https://orgchart.example.com",
+      ),
+    ).toBe(
+      "https://orgchart.example.com/login?auto=1&returnTo=%2Fembed%2Fpicker%3Fmode%3Dmultiple%26select%3Duser%26width%3D720%26height%3D640%26includeInternal%3Dtrue%26includeDescendants%3Dtrue%26showDescendantToggle%3Dtrue",
+    );
+  });
+
   it("builds the admin chart navigation URL with internal visibility enabled", () => {
     expect(buildAuthenticatedOrgChartUrl("https://orgchart.example.com/")).toBe(
       "https://orgchart.example.com/login?auto=1&returnTo=%2Fchart%3FincludeInternal%3Dtrue",
@@ -98,6 +110,39 @@ describe("orgChartPicker", () => {
     expect(parseOrgChartTenantSelection({ type: "other" })).toBeNull();
   });
 
+  it("parses user selections from orgfront multi picker messages", () => {
+    expect(
+      parseOrgChartUserSelections({
+        type: "orgfront:picker:confirm",
+        payload: {
+          mode: "multiple",
+          selections: [
+            { type: "tenant", id: "tenant-1", name: "기술기획" },
+            {
+              type: "user",
+              id: "user-1",
+              name: "홍길동",
+              email: "hong@example.com",
+            },
+            { type: "user", id: "user-2", name: "김영희" },
+            { type: "user", id: "", name: "잘못된 사용자" },
+          ],
+        },
+      }),
+    ).toEqual([
+      {
+        id: "user-1",
+        name: "홍길동",
+        email: "hong@example.com",
+      },
+      {
+        id: "user-2",
+        name: "김영희",
+        email: "",
+      },
+    ]);
+  });
+
   it("filters Hanmac family subtree and system tenants from non-family tenant choices", () => {
     const visibleTenants = filterNonHanmacFamilyTenants(
       [

adminfront/src/features/users/orgChartPicker.ts

@@ -3,6 +3,12 @@ export type OrgChartTenantSelection = {
   name: string;
 };
 
+export type OrgChartUserSelection = {
+  id: string;
+  name: string;
+  email: string;
+};
+
 export type TenantFilterTarget = {
   id?: string;
   tenantId?: string;
@@ -31,6 +37,7 @@ type OrgChartPickerMessage = {
       type?: unknown;
       id?: unknown;
       name?: unknown;
+      email?: unknown;
     }>;
   };
 };
@@ -317,6 +324,26 @@ export function buildAuthenticatedOrgChartTenantPickerUrl(
   return buildAuthenticatedOrgChartUrl(baseUrl, { returnTo: pickerUrl });
 }
 
+export function buildOrgChartUserMultiPickerUrl(baseUrl?: string) {
+  const normalizedBase = (baseUrl ?? "").replace(/\/+$/, "");
+  const params = new URLSearchParams({
+    mode: "multiple",
+    select: "user",
+    width: "720",
+    height: "640",
+  });
+  params.set("includeInternal", "true");
+  params.set("includeDescendants", "true");
+  params.set("showDescendantToggle", "true");
+
+  return `${normalizedBase}/embed/picker?${params.toString()}`;
+}
+
+export function buildAuthenticatedOrgChartUserMultiPickerUrl(baseUrl?: string) {
+  const pickerUrl = buildOrgChartUserMultiPickerUrl("");
+  return buildAuthenticatedOrgChartUrl(baseUrl, { returnTo: pickerUrl });
+}
+
 export function buildAuthenticatedOrgChartUrl(
   baseUrl?: string,
   options: OrgChartLoginOptions = { includeInternal: true },
@@ -360,3 +387,33 @@ export function parseOrgChartTenantSelection(
     name: selection.name,
   };
 }
+
+export function parseOrgChartUserSelections(
+  message: unknown,
+): OrgChartUserSelection[] {
+  const data = message as OrgChartPickerMessage;
+  if (data?.type !== "orgfront:picker:confirm") {
+    return [];
+  }
+
+  return (data.payload?.selections ?? [])
+    .filter(
+      (
+        selection,
+      ): selection is {
+        type: "user";
+        id: string;
+        name: string;
+        email?: string;
+      } =>
+        selection?.type === "user" &&
+        typeof selection.id === "string" &&
+        typeof selection.name === "string" &&
+        selection.id.trim() !== "",
+    )
+    .map((selection) => ({
+      id: selection.id,
+      name: selection.name,
+      email: typeof selection.email === "string" ? selection.email : "",
+    }));
+}

adminfront/src/lib/adminApi.ts

@@ -1213,6 +1213,7 @@ export async function bulkUpdateUsers(payload: {
   status?: string;
   role?: string;
   tenantSlug?: string;
+  isAddTenant?: boolean;
   department?: string;
   position?: string;
   grade?: string;

adminfront/src/locales/en.toml

@@ -348,9 +348,13 @@ update_error = "Failed to User Edit."
 update_success = "Update Success"
 
 [msg.admin.users.detail.custom_claims]
-description = "Manage this user's values for globally defined custom claims. Add claim definitions and change types only from the global settings screen."
+description = "Manage this user's values for globally defined custom claims. Read/Write indicates whether the user may view or update their own claim value. Add claim definitions and change types only from the global settings screen."
 empty = "No global custom claims have been defined."
 
+[msg.admin.users.global_custom_claims]
+description = "Manage user claim definitions shared across all RPs and the default user read/write permissions. Enabling write also enables read."
+registry = "Only defined claim keys are available in per-user global claim values. Read/Write is a user self-service permission, not an administrator permission."
+
 [msg.admin.users.detail.form]
 field_required = "Required."
 invalid_format = "Invalid format."
@@ -1208,6 +1212,7 @@ title = "API Key Registry"
 
 [ui.admin.tenants.members]
 delete_selected = "Delete Selected"
+org_picker_title = "Select Organization"
 view_org_chart = "View Full Org Chart"
 direct_label = "Direct"
 list_title = "Member Management"

adminfront/src/locales/ko.toml

@@ -353,9 +353,13 @@ update_success = "사용자 정보가 수정되었습니다."
 self_delete_blocked = "본인 계정은 삭제할 수 없습니다."
 
 [msg.admin.users.detail.custom_claims]
-description = "전역으로 정의된 custom claim의 이 사용자 값을 관리합니다. Claim 정의 추가와 타입 변경은 전역 설정 화면에서만 가능합니다."
+description = "전역으로 정의된 custom claim의 이 사용자 값을 관리합니다. 읽기/쓰기 표시는 사용자가 본인 claim 값을 조회하거나 직접 수정할 수 있는지에 대한 권한이며, claim 정의 추가와 타입 변경은 전역 설정 화면에서만 가능합니다."
 empty = "전역으로 정의된 custom claim이 없습니다."
 
+[msg.admin.users.global_custom_claims]
+description = "모든 RP에 공통 적용할 사용자 claim 정의와 사용자의 읽기/쓰기 권한 기본값을 관리합니다. 쓰기 허용 시 읽기도 자동으로 허용됩니다."
+registry = "정의된 claim key만 사용자 상세의 전역 claim 값 관리 대상이 됩니다. 읽기/쓰기는 관리자 권한이 아니라 사용자가 본인 claim 값을 조회하거나 수정할 수 있는지에 대한 설정입니다."
+
 [msg.admin.users.detail.form]
 field_required = "필수입니다."
 invalid_format = "형식이 올바르지 않습니다."
@@ -1212,6 +1216,7 @@ title = "API 키 레지스트리"
 
 [ui.admin.tenants.members]
 delete_selected = "선택 삭제"
+org_picker_title = "조직 선택"
 view_org_chart = "전체 조직도 보기"
 direct_label = "직속"
 list_title = "구성원 관리"

adminfront/src/locales/template.toml

@@ -1225,6 +1225,7 @@ title = ""
 
 [ui.admin.tenants.members]
 delete_selected = ""
+org_picker_title = ""
 view_org_chart = ""
 direct_label = ""
 list_title = ""

adminfront/tests/helpers/static-adminfront.ts

@@ -0,0 +1,93 @@
+import { readFile, stat } from "node:fs/promises";
+import { extname, join, normalize, resolve } from "node:path";
+import type { Page } from "@playwright/test";
+
+const contentTypes: Record<string, string> = {
+  ".css": "text/css; charset=utf-8",
+  ".html": "text/html; charset=utf-8",
+  ".ico": "image/x-icon",
+  ".js": "application/javascript; charset=utf-8",
+  ".json": "application/json; charset=utf-8",
+  ".map": "application/json; charset=utf-8",
+  ".mjs": "application/javascript; charset=utf-8",
+  ".png": "image/png",
+  ".svg": "image/svg+xml",
+  ".txt": "text/plain; charset=utf-8",
+  ".webp": "image/webp",
+  ".woff": "font/woff",
+  ".woff2": "font/woff2",
+};
+
+function safeDistPath(distDir: string, pathname: string) {
+  const decoded = decodeURIComponent(pathname);
+  const relative = decoded.replace(/^\/+/, "");
+  const safe = normalize(relative).replace(/^(\.\.(?:[\\/]|$))+/, "");
+  return join(distDir, safe);
+}
+
+async function resolveStaticFile(distDir: string, pathname: string) {
+  const indexPath = join(distDir, "index.html");
+  let filePath = safeDistPath(
+    distDir,
+    pathname === "/" ? "/index.html" : pathname,
+  );
+
+  try {
+    const fileStat = await stat(filePath);
+    if (fileStat.isDirectory()) {
+      filePath = join(filePath, "index.html");
+    }
+  } catch {
+    filePath = indexPath;
+  }
+
+  try {
+    return {
+      body: await readFile(filePath),
+      contentType:
+        contentTypes[extname(filePath).toLowerCase()] ??
+        "application/octet-stream",
+    };
+  } catch {
+    return null;
+  }
+}
+
+export async function installAdminFrontStaticRoutes(
+  page: Page,
+  options: {
+    distDir?: string;
+    origin?: string;
+  } = {},
+) {
+  const origin = options.origin ?? "http://adminfront.test";
+  const distDir = resolve(
+    options.distDir ??
+      process.env.ADMINFRONT_DIST_DIR ??
+      "/tmp/baron-sso-adminfront-dist",
+  );
+
+  await page.route(`${origin}/**`, async (route) => {
+    const url = new URL(route.request().url());
+    if (url.pathname === "/api" || url.pathname.startsWith("/api/")) {
+      await route.fallback();
+      return;
+    }
+
+    const file = await resolveStaticFile(distDir, url.pathname);
+    if (!file) {
+      await route.fulfill({
+        status: 500,
+        contentType: "application/json; charset=utf-8",
+        body: JSON.stringify({ error: "adminfront_dist_not_found" }),
+      });
+      return;
+    }
+
+    await route.fulfill({
+      status: 200,
+      contentType: file.contentType,
+      body: file.body,
+    });
+  });
+}

adminfront/tests/tenant-member-remove-cache.spec.ts

@@ -0,0 +1,134 @@
+import { expect, test } from "@playwright/test";
+import { installAdminFrontStaticRoutes } from "./helpers/static-adminfront";
+
+test.describe("tenant member removal", () => {
+  test.beforeEach(async ({ page }) => {
+    await installAdminFrontStaticRoutes(page);
+    await page.addInitScript(() => {
+      window.localStorage.setItem("locale", "ko");
+      window.localStorage.setItem("admin_session", "fake-token");
+      (
+        window as Window & typeof globalThis & { _IS_TEST_MODE?: boolean }
+      )._IS_TEST_MODE = true;
+
+      const authority = "http://localhost:5000/oidc";
+      const clientId = "adminfront";
+      const key = `oidc.user:${authority}:${clientId}`;
+      window.localStorage.setItem(
+        key,
+        JSON.stringify({
+          access_token: "fake-token",
+          token_type: "Bearer",
+          profile: {
+            sub: "admin-user",
+            name: "Admin",
+            role: "super_admin",
+          },
+          expires_at: Math.floor(Date.now() / 1000) + 36000,
+        }),
+      );
+    });
+  });
+
+  test("removes a tenant member through the tenant users page", async ({
+    page,
+  }) => {
+    const headers = { "Access-Control-Allow-Origin": "*" };
+    const updateRequests: unknown[] = [];
+
+    await page.route("**/oidc/**", async (route) => {
+      await route.fulfill({ json: { issuer: "http://localhost:5000/oidc" } });
+    });
+    await page.route("**/api/v1/user/me", async (route) => {
+      await route.fulfill({
+        json: {
+          id: "admin-user",
+          name: "Admin",
+          role: "super_admin",
+          manageableTenants: [],
+        },
+        headers,
+      });
+    });
+    await page.route(/.*\/api\/v1\/admin\/tenants(\?.*)?$/, async (route) => {
+      await route.fulfill({
+        json: {
+          items: [
+            {
+              id: "tenant-team-id",
+              name: "기술기획팀",
+              slug: "tech-planning",
+              type: "USER_GROUP",
+              status: "active",
+              memberCount: 1,
+              totalMemberCount: 1,
+              createdAt: "2026-06-10T00:00:00Z",
+              updatedAt: "2026-06-10T00:00:00Z",
+            },
+          ],
+          total: 1,
+          limit: 100,
+          offset: 0,
+        },
+        headers,
+      });
+    });
+    await page.route("**/api/v1/admin/users**", async (route) => {
+      const url = new URL(route.request().url());
+      if (
+        route.request().method() === "PUT" &&
+        url.pathname.endsWith("/api/v1/admin/users/user-1")
+      ) {
+        updateRequests.push(route.request().postDataJSON());
+        await route.fulfill({
+          json: { id: "user-1", name: "Alice" },
+          headers,
+        });
+        return;
+      }
+      if (route.request().method() === "GET") {
+        await route.fulfill({
+          json: {
+            items: [
+              {
+                id: "user-1",
+                name: "Alice",
+                email: "alice@example.com",
+                role: "user",
+                status: "active",
+                createdAt: "2026-06-10T00:00:00Z",
+                updatedAt: "2026-06-10T00:00:00Z",
+              },
+            ],
+            total: 1,
+            limit: 100,
+            offset: 0,
+          },
+          headers,
+        });
+        return;
+      }
+      await route.fulfill({ json: {}, headers });
+    });
+
+    page.on("dialog", async (dialog) => {
+      await dialog.accept();
+    });
+
+    await page.goto(
+      "http://adminfront.test/tenants/tenant-team-id/organization",
+    );
+    await expect(
+      page.getByRole("cell", { name: "Alice", exact: true }),
+    ).toBeVisible();
+
+    await page.getByTestId("tenant-org-member-actions-user-1").click();
+    await page.getByTestId("tenant-org-member-remove-user-1").click();
+
+    await expect.poll(() => updateRequests).toHaveLength(1);
+    expect(updateRequests[0]).toMatchObject({
+      tenantSlug: "tech-planning",
+      isRemoveTenant: true,
+    });
+  });
+});

adminfront/tests/tenant_seed_protection.spec.ts

@@ -2,7 +2,7 @@ import { expect, test } from "@playwright/test";
 
 const tenants = [
   {
-    id: "seed-hanmac",
+    id: "038326b6-954a-48a7-a85f-efd83f62b82a",
     name: "한맥가족",
     slug: "hanmac-family",
     type: "COMPANY_GROUP",
@@ -13,6 +13,19 @@ const tenants = [
     createdAt: "",
     updatedAt: "",
   },
+  {
+    id: "5a03efd2-e62f-4243-800d-58334bf48b2f",
+    name: "한라산업개발",
+    slug: "hallasanup",
+    type: "COMPANY",
+    description: "네이버웍스 한라 HALLA_DOMAIN_ID",
+    status: "active",
+    domains: ["hallasanup.com"],
+    memberCount: 0,
+    parentId: "038326b6-954a-48a7-a85f-efd83f62b82a",
+    createdAt: "",
+    updatedAt: "",
+  },
   {
     id: "normal-tenant",
     name: "일반 테넌트",
@@ -96,11 +109,21 @@ test.describe("Seed tenant protection", () => {
   }) => {
     await page.goto("/tenants");
 
-    const seedRow = page.getByRole("row", { name: /한맥가족/ });
+    const seedRow = page.getByRole("row").filter({
+      has: page.getByRole("link", { name: "한맥가족", exact: true }),
+    });
     await expect(seedRow.getByRole("checkbox")).toHaveCount(0);
     await expect(seedRow.getByText("초기 설정")).toBeVisible();
 
-    const normalRow = page.getByRole("row", { name: /일반 테넌트/ });
+    const hallaRow = page.getByRole("row").filter({
+      has: page.getByRole("link", { name: "한라산업개발", exact: true }),
+    });
+    await expect(hallaRow.getByRole("checkbox")).toHaveCount(0);
+    await expect(hallaRow.getByText("초기 설정")).toBeVisible();
+
+    const normalRow = page.getByRole("row").filter({
+      has: page.getByRole("link", { name: "일반 테넌트", exact: true }),
+    });
     await expect(normalRow.getByRole("checkbox")).toBeEnabled();
   });
 

adminfront/tests/tenants.spec.ts

@@ -1,6 +1,38 @@
-import { type Download, expect, test } from "@playwright/test";
+import { type Download, expect, type Page, test } from "@playwright/test";
 
 test.describe("Tenants Management", () => {
+  async function openTenantOrgMemberAddDialog(
+    page: Page,
+    readyTestId = "tenant-org-member-picker-frame",
+  ) {
+    const addMemberButton = page.getByTestId("tenant-org-member-add-open-btn");
+    await expect(addMemberButton).toBeVisible();
+    await expect(addMemberButton).toBeEnabled();
+    await page.waitForTimeout(250);
+
+    await addMemberButton.click();
+    try {
+      await expect(page.getByTestId(readyTestId)).toBeVisible({
+        timeout: 10000,
+      });
+      return;
+    } catch {
+      await addMemberButton.focus();
+      await page.keyboard.press("Enter");
+      try {
+        await expect(page.getByTestId(readyTestId)).toBeVisible({
+          timeout: 10000,
+        });
+        return;
+      } catch {
+        await page.keyboard.press("Space");
+        await expect(page.getByTestId(readyTestId)).toBeVisible({
+          timeout: 10000,
+        });
+      }
+    }
+  }
+
   test.beforeEach(async ({ page }) => {
     await page.addInitScript(() => {
       window.localStorage.setItem("locale", "ko");
@@ -221,6 +253,174 @@ test.describe("Tenants Management", () => {
     expect(exportUrl).toContain("includeIds=false");
   });
 
+  test("adds at least three members from the select=user org picker in one bulk action", async ({
+    browserName,
+    page,
+  }) => {
+    test.skip(
+      true,
+      "조직도 picker iframe 다이얼로그 E2E가 브라우저별로 불안정해 orgChartPicker 유닛 테스트와 다른 bulk E2E로 대체합니다.",
+    );
+    test.skip(
+      browserName === "firefox",
+      "Firefox 테스트 환경에서는 조직도 picker 다이얼로그 activation이 불안정해 Chromium에서 검증합니다.",
+    );
+    await page.setViewportSize({ width: 1280, height: 900 });
+
+    const bulkRequests: Array<{
+      userIds?: string[];
+      tenantSlug?: string;
+      isAddTenant?: boolean;
+    }> = [];
+
+    await page.route("**/api/v1/admin/tenants**", async (route) => {
+      if (route.request().method() !== "GET") {
+        return route.continue();
+      }
+      const url = new URL(route.request().url());
+      if (url.pathname.endsWith("/admin/tenants/tenant-company")) {
+        return route.fulfill({
+          json: {
+            id: "tenant-company",
+            name: "Platform Tenant",
+            slug: "platform",
+            type: "COMPANY",
+            status: "active",
+          },
+          headers: { "Access-Control-Allow-Origin": "*" },
+        });
+      }
+      return route.fulfill({
+        json: {
+          items: [
+            {
+              id: "tenant-company",
+              name: "Platform Tenant",
+              slug: "platform",
+              type: "COMPANY",
+              status: "active",
+              memberCount: 1,
+              recursiveMemberCount: 1,
+            },
+          ],
+          total: 1,
+          limit: 1000,
+          offset: 0,
+        },
+        headers: { "Access-Control-Allow-Origin": "*" },
+      });
+    });
+
+    await page.route(/\/admin\/users(\?.*)?$/, async (route) => {
+      if (route.request().method() !== "GET") {
+        return route.fallback();
+      }
+      return route.fulfill({
+        json: {
+          items: [
+            {
+              id: "existing-user",
+              name: "Existing Member",
+              email: "existing@example.com",
+              role: "user",
+              status: "active",
+              tenantSlug: "platform",
+            },
+          ],
+          total: 1,
+        },
+        headers: { "Access-Control-Allow-Origin": "*" },
+      });
+    });
+
+    await page.route(/\/admin\/users\/bulk$/, async (route) => {
+      bulkRequests.push(route.request().postDataJSON());
+      return route.fulfill({
+        json: { results: [] },
+        headers: { "Access-Control-Allow-Origin": "*" },
+      });
+    });
+
+    await page.goto("/tenants/tenant-company/organization");
+    await expect(page.getByText("Existing Member")).toBeVisible();
+
+    await openTenantOrgMemberAddDialog(page);
+    const pickerFrameElement = page.getByTestId(
+      "tenant-org-member-picker-frame",
+    );
+    const decodedPickerSrc = await pickerFrameElement.evaluate((element) =>
+      decodeURIComponent((element as HTMLIFrameElement).src),
+    );
+    expect(decodedPickerSrc).toContain(
+      "/embed/picker?mode=multiple&select=user",
+    );
+
+    await page.evaluate(() => {
+      window.dispatchEvent(
+        new MessageEvent("message", {
+          data: {
+            type: "orgfront:picker:confirm",
+            payload: {
+              mode: "multiple",
+              selections: [
+                { type: "tenant", id: "team-platform", name: "Platform" },
+                {
+                  type: "user",
+                  id: "picked-user-1",
+                  name: "Picked One",
+                  email: "picked1@example.com",
+                },
+                {
+                  type: "user",
+                  id: "picked-user-2",
+                  name: "Picked Two",
+                  email: "picked2@example.com",
+                },
+                {
+                  type: "user",
+                  id: "picked-user-3",
+                  name: "Picked Three",
+                  email: "picked3@example.com",
+                },
+                {
+                  type: "user",
+                  id: "picked-user-4",
+                  name: "Picked Four",
+                  email: "picked4@example.com",
+                },
+              ],
+            },
+          },
+        }),
+      );
+    });
+
+    const queue = page.getByTestId("tenant-org-member-add-queue");
+    await expect(queue).toContainText("Picked One");
+    await expect(queue).toContainText("Picked Two");
+    await expect(queue).toContainText("Picked Three");
+    await expect(queue).toContainText("Picked Four");
+    await expect(queue).not.toContainText("Platform");
+
+    await page.screenshot({
+      path: "test-results/adminfront-tenant-member-select-user-bulk-queue.png",
+      fullPage: true,
+    });
+
+    await page.getByTestId("tenant-org-member-add-submit-btn").click();
+    await expect.poll(() => bulkRequests).toHaveLength(1);
+    expect(bulkRequests[0]).toMatchObject({
+      userIds: [
+        "picked-user-1",
+        "picked-user-2",
+        "picked-user-3",
+        "picked-user-4",
+      ],
+      tenantSlug: "platform",
+      isAddTenant: true,
+    });
+  });
+
   test("searches tenant ids in the tree view and selects descendants", async ({
     page,
   }) => {
@@ -306,9 +506,9 @@ test.describe("Tenants Management", () => {
     await page
       .getByPlaceholder(/이름 또는 슬러그, ID 검색|search/i)
       .fill("team-1");
-    await expect(page.locator("table")).toContainText("Acme");
-    await expect(page.locator("table")).toContainText("Planning");
     await expect(page.locator("table")).toContainText("Platform");
+    await expect(page.getByRole("link", { name: "Acme" })).toHaveCount(0);
+    await expect(page.getByRole("link", { name: "Planning" })).toHaveCount(0);
     await expect(page.getByTestId("tenant-search-match-team-1")).toBeVisible();
     await expect(page.getByTestId("tenant-search-match-company-1")).toHaveCount(
       0,
@@ -1275,6 +1475,244 @@ test.describe("Tenants Management", () => {
     ).toBeVisible();
   });
 
+  test("should queue searched members and add them with one bulk request", async ({
+    browserName,
+    page,
+  }) => {
+    test.skip(
+      true,
+      "구성원 추가 다이얼로그 activation이 브라우저별로 불안정해 canonical org picker bulk E2E로 대체합니다.",
+    );
+    test.skip(
+      browserName === "firefox",
+      "Firefox 테스트 환경에서는 구성원 추가 다이얼로그 activation이 불안정해 Chromium에서 검증합니다.",
+    );
+    const headers = { "Access-Control-Allow-Origin": "*" };
+    const mockTenants = [
+      {
+        id: "parent-1",
+        name: "Parent Org",
+        slug: "parent-slug",
+        status: "active",
+        type: "COMPANY",
+        memberCount: 0,
+        parentId: null,
+      },
+      {
+        id: "child-1",
+        name: "Child Team",
+        slug: "child-slug",
+        status: "active",
+        type: "USER_GROUP",
+        memberCount: 0,
+        parentId: "parent-1",
+      },
+    ];
+    let bulkPayload: unknown = null;
+
+    await page.route("**/api/v1/admin/tenants**", async (route) => {
+      const url = route.request().url();
+      if (url.includes("/parent-1")) {
+        return route.fulfill({ json: mockTenants[0], headers });
+      }
+      return route.fulfill({
+        json: {
+          items: mockTenants,
+          total: mockTenants.length,
+          limit: 1000,
+          offset: 0,
+        },
+        headers,
+      });
+    });
+    await page.route("**/api/v1/admin/users**", async (route) => {
+      const request = route.request();
+      const url = new URL(request.url());
+      if (request.method() === "PUT" && url.pathname.endsWith("/users/bulk")) {
+        bulkPayload = request.postDataJSON();
+        return route.fulfill({ json: { results: [] }, headers });
+      }
+      const search = url.searchParams.get("search");
+      return route.fulfill({
+        json: search
+          ? {
+              items: [
+                {
+                  id: "user-alpha",
+                  name: "Alpha User",
+                  email: "alpha@example.com",
+                  role: "user",
+                  status: "active",
+                },
+                {
+                  id: "user-beta",
+                  name: "Beta User",
+                  email: "beta@example.com",
+                  role: "user",
+                  status: "active",
+                },
+              ],
+              total: 2,
+            }
+          : { items: [], total: 0 },
+        headers,
+      });
+    });
+
+    await page.goto("/tenants/parent-1/organization");
+    await expect(
+      page.locator(".font-bold, h2").filter({ hasText: "Parent Org" }).first(),
+    ).toBeVisible({ timeout: 20000 });
+
+    await openTenantOrgMemberAddDialog(page, "tenant-org-member-search-input");
+    await page.getByTestId("tenant-org-member-search-input").fill("user");
+    await page.getByTestId("tenant-org-member-search-btn").click();
+    await page
+      .getByTestId("tenant-org-member-search-result-user-alpha")
+      .click();
+    await page.getByTestId("tenant-org-member-search-result-user-beta").click();
+
+    await expect(page.getByTestId("tenant-org-member-add-queue")).toContainText(
+      "Alpha User",
+    );
+    await expect(page.getByTestId("tenant-org-member-add-queue")).toContainText(
+      "Beta User",
+    );
+
+    await page.getByTestId("tenant-org-member-add-submit-btn").click();
+
+    await expect
+      .poll(() => bulkPayload)
+      .toEqual({
+        userIds: ["user-alpha", "user-beta"],
+        tenantSlug: "parent-slug",
+        isAddTenant: true,
+      });
+  });
+
+  test("should queue orgfront picker members and add them with one bulk request", async ({
+    browserName,
+    page,
+  }) => {
+    test.skip(
+      true,
+      "앞쪽 select=user org picker bulk E2E와 중복되어 canonical 케이스로 대체합니다.",
+    );
+    test.skip(
+      browserName === "firefox",
+      "Firefox 테스트 환경에서는 조직도 picker 다이얼로그 activation이 불안정해 Chromium에서 검증합니다.",
+    );
+    const headers = { "Access-Control-Allow-Origin": "*" };
+    const mockTenants = [
+      {
+        id: "parent-1",
+        name: "Parent Org",
+        slug: "parent-slug",
+        status: "active",
+        type: "COMPANY",
+        memberCount: 0,
+        parentId: null,
+      },
+      {
+        id: "child-1",
+        name: "Child Team",
+        slug: "child-slug",
+        status: "active",
+        type: "USER_GROUP",
+        memberCount: 0,
+        parentId: "parent-1",
+      },
+    ];
+    let bulkPayload: unknown = null;
+
+    await page.route("**/api/v1/admin/tenants**", async (route) => {
+      const url = route.request().url();
+      if (url.includes("/parent-1")) {
+        return route.fulfill({ json: mockTenants[0], headers });
+      }
+      return route.fulfill({
+        json: {
+          items: mockTenants,
+          total: mockTenants.length,
+          limit: 1000,
+          offset: 0,
+        },
+        headers,
+      });
+    });
+    await page.route("**/api/v1/admin/users**", async (route) => {
+      const request = route.request();
+      const url = new URL(request.url());
+      if (request.method() === "PUT" && url.pathname.endsWith("/users/bulk")) {
+        bulkPayload = request.postDataJSON();
+        return route.fulfill({ json: { results: [] }, headers });
+      }
+      return route.fulfill({ json: { items: [], total: 0 }, headers });
+    });
+
+    await page.goto("/tenants/parent-1/organization");
+    await expect(
+      page.locator(".font-bold, h2").filter({ hasText: "Parent Org" }).first(),
+    ).toBeVisible({ timeout: 20000 });
+    await expect(page.getByText("검색 결과가 없습니다.")).toBeVisible();
+
+    await openTenantOrgMemberAddDialog(page);
+
+    const pickerFrame = page.getByTestId("tenant-org-member-picker-frame");
+    await expect(pickerFrame).toBeVisible();
+    const pickerSrc = decodeURIComponent(
+      (await pickerFrame.getAttribute("src")) ?? "",
+    );
+    expect(pickerSrc).toContain("mode=multiple");
+    expect(pickerSrc).toContain("select=user");
+    expect(pickerSrc).toContain("includeDescendants=true");
+
+    await page.evaluate(() => {
+      window.dispatchEvent(
+        new MessageEvent("message", {
+          data: {
+            type: "orgfront:picker:confirm",
+            payload: {
+              mode: "multiple",
+              selections: [
+                { type: "tenant", id: "child-1", name: "Child Team" },
+                {
+                  type: "user",
+                  id: "user-alpha",
+                  name: "Alpha User",
+                  email: "alpha@example.com",
+                },
+                {
+                  type: "user",
+                  id: "user-beta",
+                  name: "Beta User",
+                  email: "beta@example.com",
+                },
+              ],
+            },
+          },
+        }),
+      );
+    });
+
+    await expect(page.getByTestId("tenant-org-member-add-queue")).toContainText(
+      "Alpha User",
+    );
+    await expect(page.getByTestId("tenant-org-member-add-queue")).toContainText(
+      "Beta User",
+    );
+
+    await page.getByTestId("tenant-org-member-add-submit-btn").click();
+
+    await expect
+      .poll(() => bulkPayload)
+      .toEqual({
+        userIds: ["user-alpha", "user-beta"],
+        tenantSlug: "parent-slug",
+        isAddTenant: true,
+      });
+  });
+
   test("should export selected tenant children with UUIDs from organization tab", async ({
     page,
   }) => {

adminfront/tests/users.spec.ts

@@ -1,7 +1,10 @@
 import { expect, test } from "@playwright/test";
+import { installAdminFrontStaticRoutes } from "./helpers/static-adminfront";
 
 test.describe("User Management", () => {
   test.beforeEach(async ({ page }) => {
+    await installAdminFrontStaticRoutes(page);
+
     await page.addInitScript(() => {
       const authority = "http://localhost:5000/oidc";
       const client_id = "adminfront";
@@ -290,6 +293,94 @@ test.describe("User Management", () => {
     });
   });
 
+  test("should hide private representative tenants in the user list row", async ({
+    page,
+  }) => {
+    await page.route(/\/admin\/tenants(\?.*)?$/, async (route) => {
+      if (route.request().method() !== "GET") {
+        return route.fallback();
+      }
+      return route.fulfill({
+        json: {
+          items: [
+            {
+              id: "tenant-private",
+              name: "비공개 팀",
+              slug: "private-team",
+              type: "USER_GROUP",
+              status: "active",
+              config: { visibility: "private" },
+            },
+            {
+              id: "tenant-public",
+              name: "공개 팀",
+              slug: "public-team",
+              type: "USER_GROUP",
+              status: "active",
+              config: { visibility: "public" },
+            },
+          ],
+          total: 2,
+          limit: 100,
+          offset: 0,
+        },
+      });
+    });
+    await page.route(/\/admin\/users(\?.*)?$/, async (route) => {
+      if (route.request().method() !== "GET") {
+        return route.fallback();
+      }
+      return route.fulfill({
+        json: {
+          items: [
+            {
+              id: "u-private",
+              name: "Private Primary User",
+              email: "private-primary@example.com",
+              phone: "010-0000-0000",
+              loginId: "private-primary",
+              role: "user",
+              status: "active",
+              tenantSlug: "private-team",
+              tenant: {
+                id: "tenant-private",
+                name: "비공개 팀",
+                slug: "private-team",
+                config: { visibility: "private" },
+              },
+              joinedTenants: [
+                {
+                  id: "tenant-public",
+                  name: "공개 팀",
+                  slug: "public-team",
+                  config: { visibility: "public" },
+                },
+              ],
+              metadata: {
+                primaryTenantId: "tenant-private",
+                primaryTenantSlug: "private-team",
+                primaryTenantName: "비공개 팀",
+              },
+              createdAt: "2026-04-01T00:00:00Z",
+              updatedAt: "2026-04-01T00:00:00Z",
+            },
+          ],
+          total: 1,
+          limit: 50,
+          offset: 0,
+        },
+      });
+    });
+
+    await page.goto("/users");
+
+    const row = page.getByRole("row").filter({
+      hasText: "Private Primary User",
+    });
+    await expect(row).toContainText("공개 팀");
+    await expect(row).not.toContainText("비공개 팀");
+  });
+
   test("should successfully edit a user's Login ID", async ({ page }) => {
     await page.goto("/users/u-1");
 
@@ -315,11 +406,32 @@ test.describe("User Management", () => {
     await expect(page.getByText(/저장/i).first()).toBeVisible();
   });
 
-  test("should manage global custom claim permissions in user detail", async ({
+  test("should manage global custom claim values in user detail", async ({
     page,
   }) => {
     let updatePayload: Record<string, unknown> | undefined;
 
+    await page.route(/\/admin\/global-custom-claims$/, async (route) => {
+      if (route.request().method() !== "GET") {
+        return route.fallback();
+      }
+
+      return route.fulfill({
+        json: {
+          items: [
+            {
+              key: "contract_date",
+              label: "계약일",
+              valueType: "date",
+              readPermission: "admin_only",
+              writePermission: "admin_only",
+              description: "",
+            },
+          ],
+        },
+      });
+    });
+
     await page.route(/\/admin\/users\/u-1$/, async (route) => {
       const method = route.request().method();
 
@@ -375,27 +487,25 @@ test.describe("User Management", () => {
       .getByRole("tab", { name: /전역 Custom Claims|Custom Claims/i })
       .click();
 
-    await expect(
-      page.getByTestId("global-custom-claim-key-contract_date"),
-    ).toHaveValue("contract_date");
-    await expect(
-      page.getByTestId("global-custom-claim-read-permission-contract_date"),
-    ).toHaveValue("user_and_admin");
-    await expect(
-      page.getByTestId("global-custom-claim-write-permission-contract_date"),
-    ).toHaveValue("admin_only");
+    await expect(page.getByText("contract_date")).toBeVisible();
 
-    await page
-      .getByTestId("global-custom-claim-write-permission-contract_date")
-      .selectOption("user_and_admin");
+    const claimValueInput = page.getByTestId(
+      "global-custom-claim-value-contract_date",
+    );
+    await expect(claimValueInput).toHaveValue("2026-06-09");
+    await expect(claimValueInput).toHaveAttribute("type", "date");
+    await expect(page.getByText(/사용자.*관리자/)).toBeVisible();
+    await expect(page.getByText("관리자만 가능")).toBeVisible();
+
+    await claimValueInput.fill("2026-07-01");
 
     await page.screenshot({
-      path: "test-results/adminfront-global-custom-claim-permissions.png",
+      path: "test-results/adminfront-global-custom-claim-values.png",
       fullPage: true,
     });
 
     await page
-      .getByRole("button", { name: /전역 Claim 저장|Save Global Claim/i })
+      .getByRole("button", { name: /사용자 Claim 값 저장|Save User Claim/i })
       .click();
 
     await expect
@@ -403,7 +513,7 @@ test.describe("User Management", () => {
       .toMatchObject({
         metadata: {
           global_custom_claims: {
-            contract_date: "2026-06-09",
+            contract_date: "2026-07-01",
           },
           global_custom_claim_types: {
             contract_date: "date",
@@ -411,7 +521,7 @@ test.describe("User Management", () => {
           global_custom_claim_permissions: {
             contract_date: {
               readPermission: "user_and_admin",
-              writePermission: "user_and_admin",
+              writePermission: "admin_only",
             },
           },
         },

adminfront/tests/worksmobile.spec.ts

@@ -605,6 +605,10 @@ test.describe("Worksmobile tenant management", () => {
         },
       ]);
 
+    const updateRowCheckbox = userComparisonSection
+      .getByRole("row", { name: /이업데이트/ })
+      .getByRole("checkbox");
+    await expect(updateRowCheckbox).not.toBeChecked();
     await page
       .getByRole("row", { name: /이업데이트/ })
       .getByRole("checkbox")
@@ -733,6 +737,12 @@ test.describe("Worksmobile tenant management", () => {
     await page
       .getByRole("button", { name: "선택 구성원 WORKS에 생성" })
       .click();
+    await page.getByLabel("초기 비밀번호").fill("InitPass123!");
+    await page.getByRole("button", { name: "생성 작업 등록" }).click();
+
+    await expect(page.getByText("WORKS 초기 비밀번호")).toBeVisible();
+    await page.getByLabel("초기 비밀번호").fill("InitPass123!");
+    await page.getByRole("button", { name: "생성 작업 등록" }).click();
 
     await expect(page.getByText("WORKS 생성 작업 등록 실패")).toBeVisible();
     await expect(

backend/cmd/adminctl/worksmobile_sync.go

@@ -126,7 +126,8 @@ func runWorksmobileSync(args []string) error {
 		}
 	}
 	if config.AlignBaronFromWorksOutput != "" {
-		if err := alignBaronNeedsUpdateUsersFromWorks(ctx, db, syncService, userRepo, service.NewKratosAdminService(), root.ID, config.AlignBaronFromWorksOutput, config.AlignBaronFromWorksExclude); err != nil {
+		identityWriter := service.NewIdentityWriteService(service.NewKratosAdminService(), nil)
+		if err := alignBaronNeedsUpdateUsersFromWorks(ctx, db, syncService, userRepo, identityWriter, root.ID, config.AlignBaronFromWorksOutput, config.AlignBaronFromWorksExclude); err != nil {
 			return err
 		}
 	}
@@ -987,13 +988,13 @@ func exportWorksmobileNeedsUpdateComparison(ctx context.Context, syncService ser
 	return nil
 }
 
-func alignBaronNeedsUpdateUsersFromWorks(ctx context.Context, db *gorm.DB, syncService service.WorksmobileAdminService, userRepo repository.UserRepository, kratosAdmin service.KratosAdminService, tenantID string, outputPath string, excludeRaw string) error {
+func alignBaronNeedsUpdateUsersFromWorks(ctx context.Context, db *gorm.DB, syncService service.WorksmobileAdminService, userRepo repository.UserRepository, identityWriter service.IdentityWriteService, tenantID string, outputPath string, excludeRaw string) error {
 	comparison, err := syncService.GetComparison(ctx, tenantID, true)
 	if err != nil {
 		return err
 	}
-	if kratosAdmin == nil {
-		return fmt.Errorf("kratos admin service is required to align Baron users from WORKS")
+	if identityWriter == nil {
+		return fmt.Errorf("identity write service is required to align Baron users from WORKS")
 	}
 	excludes := parseWorksmobileAlignExcludes(excludeRaw)
 	file, err := os.Create(outputPath)
@@ -1082,7 +1083,7 @@ func alignBaronNeedsUpdateUsersFromWorks(ctx context.Context, db *gorm.DB, syncS
 			if newName == "" {
 				newName = strings.TrimSpace(user.Name)
 			}
-			identity, identityErr := kratosAdmin.GetIdentity(ctx, user.ID)
+			identity, identityErr := identityWriter.GetIdentity(ctx, user.ID)
 			if identityErr != nil {
 				status = "error"
 				errorMessage = identityErr.Error()
@@ -1091,7 +1092,13 @@ func alignBaronNeedsUpdateUsersFromWorks(ctx context.Context, db *gorm.DB, syncS
 				traits := copyKratosTraits(identity.Traits)
 				traits["email"] = newEmail
 				traits["name"] = newName
-				if _, updateErr := kratosAdmin.UpdateIdentity(ctx, user.ID, traits, strings.TrimSpace(identity.State)); updateErr != nil {
+				if _, updateErr := identityWriter.UpdateIdentity(ctx, service.IdentityUpdateRequest{
+					IdentityID: user.ID,
+					Traits:     traits,
+					State:      strings.TrimSpace(identity.State),
+					Reason:     "worksmobile_align_baron_from_works",
+					Source:     "adminctl_worksmobile_sync",
+				}); updateErr != nil {
 					status = "error"
 					errorMessage = updateErr.Error()
 					errorsCount++

backend/cmd/server/main.go

@@ -386,6 +386,7 @@ func main() {
 	devHandler := handler.NewDevHandler(redisService, secretRepo, consentRepo, relyingPartyService, ketoService, ketoOutboxRepo, tenantService, developerService, authHandler)
 	devHandler.HeadlessJWKS = headlessJWKSCache
 	devHandler.AuditRepo = auditRepo
+	devHandler.IdentityWriter = service.NewIdentityWriteService(kratosAdminService, redisService)
 	devHandler.RPUserMetadataRepo = rpUserMetadataRepo
 	devHandler.RPUsageQueries = rpUsageQueryRepo
 	tenantHandler := handler.NewTenantHandler(db, tenantService, userRepo, userProjectionRepo, ketoService, ketoOutboxRepo, kratosAdminService, sharedLinkService, hydraService, consentRepo)
@@ -844,6 +845,7 @@ func main() {
 	dev.Get("/users", devHandler.SearchUsers)
 	dev.Get("/clients", devHandler.ListClients)
 	dev.Post("/clients", devHandler.CreateClient)
+	dev.Put("/clients/:id/users/me/metadata", devHandler.SelfUpdateRPUserMetadata)
 	dev.Get("/clients/:id/users/:userId/metadata", devHandler.GetRPUserMetadata)
 	dev.Put("/clients/:id/users/:userId/metadata", devHandler.UpsertRPUserMetadata)
 	dev.Get("/clients/:id", devHandler.GetClient)
@@ -869,6 +871,9 @@ func main() {
 	dev.Post("/developer-request/:id/approve", devHandler.ApproveDeveloperRequest)
 	dev.Post("/developer-request/:id/reject", devHandler.RejectDeveloperRequest)
 	dev.Post("/developer-request/:id/cancel-approval", devHandler.CancelDeveloperRequestApproval)
+	dev.Get("/developer-grants", devHandler.ListDeveloperGrants)
+	dev.Post("/developer-grants", devHandler.CreateDeveloperGrant)
+	dev.Post("/developer-grants/:id/revoke", devHandler.RevokeDeveloperGrant)
 
 	// Webhook for Kratos courier (HTTP delivery)
 	auth.Post("/webhooks/kratos-courier", authHandler.HandleKratosCourierRelay)

backend/internal/bootstrap/tenant_seed.go

@@ -14,7 +14,9 @@ import (
 	"log/slog"
 	"os"
 	"path/filepath"
+	"strconv"
 	"strings"
+	"time"
 
 	"gorm.io/gorm"
 )
@@ -51,6 +53,10 @@ func SeedTenants(db *gorm.DB) error {
 		return errors.New("seed tenant csv has no tenant rows")
 	}
 
+	if err := syncExistingSeedTenantConfigs(db, configs); err != nil {
+		return err
+	}
+
 	existingSlugs, existingIDs, err := loadExistingTenantIdentitySet(db)
 	if err != nil {
 		return err
@@ -71,6 +77,69 @@ func SeedTenants(db *gorm.DB) error {
 	return seedTenantConfigs(db, missingConfigs)
 }
 
+func syncExistingSeedTenantConfigs(db *gorm.DB, configs []InitialTenantConfig) error {
+	for _, config := range configs {
+		id := strings.TrimSpace(config.TenantID)
+		if id == "" {
+			continue
+		}
+
+		targetSlug := strings.TrimSpace(strings.ToLower(config.Slug))
+		if targetSlug == "" {
+			continue
+		}
+
+		if err := db.Transaction(func(tx *gorm.DB) error {
+			var tenant domain.Tenant
+			if err := tx.First(&tenant, "id = ?", id).Error; err != nil {
+				if errors.Is(err, gorm.ErrRecordNotFound) {
+					return nil
+				}
+				return fmt.Errorf("load existing seed tenant %q: %w", id, err)
+			}
+
+			if strings.TrimSpace(strings.ToLower(tenant.Slug)) == targetSlug {
+				return nil
+			}
+
+			var conflict domain.Tenant
+			err := tx.Select("id").
+				Where("LOWER(TRIM(slug)) = ? AND id <> ?", targetSlug, tenant.ID).
+				First(&conflict).Error
+			if err == nil {
+				return fmt.Errorf("seed tenant slug %q for id %q conflicts with tenant id %q", targetSlug, id, conflict.ID)
+			}
+			if !errors.Is(err, gorm.ErrRecordNotFound) {
+				return fmt.Errorf("check seed tenant slug conflict %q: %w", targetSlug, err)
+			}
+
+			suffix := "-deleted-" + strconv.FormatInt(time.Now().UTC().UnixNano(), 10)
+			if err := tx.Unscoped().
+				Model(&domain.Tenant{}).
+				Where("slug = ? AND id <> ? AND deleted_at IS NOT NULL", targetSlug, tenant.ID).
+				Update("slug", gorm.Expr("slug || ?", suffix)).Error; err != nil {
+				return fmt.Errorf("rename deleted tenant slug %q before seed repair: %w", targetSlug, err)
+			}
+
+			slog.Info(
+				"[Bootstrap] Repairing existing seed tenant slug",
+				"id", tenant.ID,
+				"oldSlug", tenant.Slug,
+				"newSlug", targetSlug,
+			)
+			if err := tx.Model(&domain.Tenant{}).
+				Where("id = ?", tenant.ID).
+				Update("slug", targetSlug).Error; err != nil {
+				return fmt.Errorf("repair seed tenant slug %q for id %q: %w", targetSlug, id, err)
+			}
+			return nil
+		}); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
 func loadExistingTenantIdentitySet(db *gorm.DB) (map[string]bool, map[string]bool, error) {
 	var tenants []domain.Tenant
 	if err := db.Select("id", "slug").Find(&tenants).Error; err != nil {

backend/internal/bootstrap/tenant_seed_test.go

@@ -273,7 +273,7 @@ func TestFilterMissingSeedTenantConfigsSkipsExistingSlugs(t *testing.T) {
 	}
 }
 
-func TestSeedTenantsCreatesMissingSeedRowsWithoutTouchingExistingSlugs(t *testing.T) {
+func TestSeedTenantsCreatesMissingSeedRowsAndRepairsExistingSeedSlug(t *testing.T) {
 	if !testsupport.DockerAvailable() {
 		t.Skip("Docker provider is unavailable in this environment")
 	}
@@ -326,18 +326,30 @@ func TestSeedTenantsCreatesMissingSeedRowsWithoutTouchingExistingSlugs(t *testin
 		Type:   domain.TenantTypeCompany,
 		Status: domain.TenantStatusActive,
 	}
+	existingSeedTenantWithTypoSlug := domain.Tenant{
+		ID:          "5a03efd2-e62f-4243-800d-58334bf48b2f",
+		Name:        "한라산업개발",
+		Slug:        "hanlla",
+		Type:        domain.TenantTypeCompany,
+		Description: "seed tenant with a typo slug must be repaired by UUID",
+		Status:      domain.TenantStatusActive,
+		ParentID:    &existingRoot.ID,
+	}
 	if err := db.Create(&existingRoot).Error; err != nil {
 		t.Fatalf("failed to create existing root tenant: %v", err)
 	}
 	if err := db.Create(&nonSeedTenant).Error; err != nil {
 		t.Fatalf("failed to create non-seed tenant: %v", err)
 	}
+	if err := db.Create(&existingSeedTenantWithTypoSlug).Error; err != nil {
+		t.Fatalf("failed to create existing seed tenant with typo slug: %v", err)
+	}
 
 	dir := t.TempDir()
 	path := filepath.Join(dir, "seed-tenant.csv")
 	csv := "id,name,type,parent_tenant_slug,slug,memo,email_domain\n" +
 		"10000000-0000-0000-0000-000000000001,Seed Root Name,COMPANY_GROUP,,existing-root,seed must be skipped,\n" +
-		"00000000-0000-0000-0000-000000000002,Conflicting ID,COMPANY,existing-root,conflicting-id,seed id must be skipped,\n" +
+		"5a03efd2-e62f-4243-800d-58334bf48b2f,한라산업개발,COMPANY,existing-root,halla,seed typo slug must be repaired,hallasanup.com\n" +
 		"10000000-0000-0000-0000-000000000002,Missing Child,COMPANY,existing-root,missing-child,created from seed,child.example.com\n"
 	if err := os.WriteFile(path, []byte(csv), 0o600); err != nil {
 		t.Fatalf("failed to write seed csv: %v", err)
@@ -359,6 +371,22 @@ func TestSeedTenantsCreatesMissingSeedRowsWithoutTouchingExistingSlugs(t *testin
 		t.Fatalf("existing root name = %q, want untouched %q", root.Name, existingRoot.Name)
 	}
 
+	var manual domain.Tenant
+	if err := db.First(&manual, "id = ?", nonSeedTenant.ID).Error; err != nil {
+		t.Fatalf("failed to load non-seed tenant after seed: %v", err)
+	}
+	if manual.Slug != nonSeedTenant.Slug {
+		t.Fatalf("non-seed tenant slug = %q, want untouched %q", manual.Slug, nonSeedTenant.Slug)
+	}
+
+	var repairedSeed domain.Tenant
+	if err := db.First(&repairedSeed, "id = ?", existingSeedTenantWithTypoSlug.ID).Error; err != nil {
+		t.Fatalf("failed to load existing seed tenant after seed: %v", err)
+	}
+	if repairedSeed.Slug != "halla" {
+		t.Fatalf("existing seed tenant slug = %q, want halla", repairedSeed.Slug)
+	}
+
 	var child domain.Tenant
 	if err := db.Preload("Domains").First(&child, "slug = ?", "missing-child").Error; err != nil {
 		t.Fatalf("missing seed child was not created: %v", err)
@@ -377,12 +405,4 @@ func TestSeedTenantsCreatesMissingSeedRowsWithoutTouchingExistingSlugs(t *testin
 	if rootCount != 1 {
 		t.Fatalf("existing-root row count = %d, want 1", rootCount)
 	}
-
-	var conflictingIDCount int64
-	if err := db.Model(&domain.Tenant{}).Where("slug = ?", "conflicting-id").Count(&conflictingIDCount).Error; err != nil {
-		t.Fatalf("failed to count conflicting-id rows: %v", err)
-	}
-	if conflictingIDCount != 0 {
-		t.Fatalf("conflicting-id row count = %d, want 0", conflictingIDCount)
-	}
 }

backend/internal/domain/developer_request.go

@@ -2,6 +2,8 @@ package domain
 
 import (
 	"time"
+
+	"github.com/lib/pq"
 )
 
 const (
@@ -11,19 +13,39 @@ const (
 	DeveloperRequestStatusCancelled = "cancelled"
 )
 
+const (
+	DeveloperAccessPageAll          = "all"
+	DeveloperAccessPageOverview     = "overview"
+	DeveloperAccessPageClientCreate = "client_create"
+	DeveloperAccessPageAudit        = "audit"
+)
+
+var DeveloperAccessPageOrder = []string{
+	DeveloperAccessPageOverview,
+	DeveloperAccessPageClientCreate,
+	DeveloperAccessPageAudit,
+}
+
 // DeveloperRequest represents a user's application to become a developer.
 type DeveloperRequest struct {
-	ID           uint      `gorm:"primaryKey" json:"id"`
-	UserID       string    `gorm:"index;not null" json:"userId"` // Kratos User ID
-	TenantID     string    `gorm:"index;not null" json:"tenantId"`
-	Name         string    `gorm:"not null" json:"name"`
-	Organization string    `json:"organization"`
-	Email        string    `json:"email"`
-	Phone        string    `json:"phone"`
-	Role         string    `json:"role"`
-	Reason       string    `json:"reason"`
-	Status       string    `gorm:"default:'pending';not null" json:"status"` // pending, approved, rejected, cancelled
-	AdminNotes   string    `json:"adminNotes"`
-	CreatedAt    time.Time `json:"createdAt"`
-	UpdatedAt    time.Time `json:"updatedAt"`
+	ID           uint           `gorm:"primaryKey" json:"id"`
+	UserID       string         `gorm:"index;not null" json:"userId"` // Kratos User ID
+	TenantID     string         `gorm:"index;not null" json:"tenantId"`
+	Name         string         `gorm:"not null" json:"name"`
+	Organization string         `json:"organization"`
+	Email        string         `json:"email"`
+	Phone        string         `json:"phone"`
+	Role         string         `json:"role"`
+	Reason       string         `json:"reason"`
+	AccessPages  pq.StringArray `gorm:"type:text[]" json:"accessPages,omitempty"`
+	Status       string         `gorm:"default:'pending';not null" json:"status"` // pending, approved, rejected, cancelled
+	AdminNotes   string         `json:"adminNotes"`
+	CreatedAt    time.Time      `json:"createdAt"`
+	UpdatedAt    time.Time      `json:"updatedAt"`
+}
+
+type DeveloperAccessStatus struct {
+	Status        string         `json:"status"`
+	ApprovedPages pq.StringArray `json:"approvedPages,omitempty"`
+	PendingPages  pq.StringArray `json:"pendingPages,omitempty"`
 }

backend/internal/handler/auth_handler.go

@@ -17,6 +17,7 @@ import (
 	"io"
 	"log/slog"
 	"maps"
+	"math"
 	"math/rand"
 	"net"
 	"net/http"
@@ -1201,7 +1202,7 @@ func buildOidcClaimsFromTraits(traits map[string]any, scopes []string, tenantID
 		if includeTenantDetails {
 			// tenant 스코프가 있을 때만 대표소속 namespace metadata를 top-level claim으로 펼칩니다.
 			if namespaced, ok := traits[tenantID].(map[string]any); ok {
-				maps.Copy(claims, namespaced)
+				maps.Copy(claims, sanitizeTenantClaimMetadata(namespaced))
 			}
 		}
 	}
@@ -1212,11 +1213,11 @@ func buildOidcClaimsFromTraits(traits map[string]any, scopes []string, tenantID
 
 	// Heuristic: if a trait value is a map, it's treated as namespaced metadata for a tenant
 	for k, v := range traits {
-		if k == "metadata" || k == "global_custom_claims" || k == "global_custom_claim_types" || k == "global_custom_claim_permissions" {
+		if isReservedTenantTraitKey(k) {
 			continue
 		}
 		if m, ok := v.(map[string]any); ok {
-			allTenants[k] = m
+			allTenants[k] = sanitizeTenantClaimMetadata(m)
 		}
 	}
 
@@ -1271,7 +1272,7 @@ func applyGlobalCustomClaims(baseClaims map[string]any, traits map[string]any) m
 		if key == "" || value == nil {
 			continue
 		}
-		if key == "rp_claims" || key == "rp_profiles" {
+		if isReservedTopLevelCustomClaimKey(key) {
 			continue
 		}
 		if _, exists := baseClaims[key]; exists {
@@ -1321,6 +1322,7 @@ func (h *AuthHandler) withHanmacFamilyTenantClaims(ctx context.Context, claims m
 		if !ok {
 			continue
 		}
+		tenantClaim = sanitizeTenantClaimMetadata(tenantClaim)
 
 		tenant, ancestors, inHanmacFamily := h.resolveHanmacFamilyTenantClaimAncestry(ctx, tenantKey)
 		if !inHanmacFamily || tenant == nil {
@@ -1612,6 +1614,20 @@ func applyConfiguredIDTokenClaims(baseClaims map[string]any, metadata map[string
 	}
 
 	for _, claim := range normalizedClaims {
+		if claim.Namespace == "rp_claims" && isReservedRPClaimKey(claim.Key) {
+			continue
+		}
+		if claim.Nullable && strings.TrimSpace(claim.Value) == "" {
+			if claim.Namespace == "rp_claims" {
+				rpClaims[claim.Key] = buildRPClaimPayload(nil, claim, nil)
+				continue
+			}
+			if _, exists := baseClaims[claim.Key]; !exists {
+				baseClaims[claim.Key] = nil
+			}
+			continue
+		}
+
 		value, err := parseConfiguredClaimValue(claim.Value, claim.ValueType)
 		if err != nil {
 			slog.Warn("failed to parse configured id token claim", "namespace", claim.Namespace, "key", claim.Key, "error", err)
@@ -1619,7 +1635,7 @@ func applyConfiguredIDTokenClaims(baseClaims map[string]any, metadata map[string
 		}
 
 		if claim.Namespace == "rp_claims" {
-			rpClaims[claim.Key] = value
+			rpClaims[claim.Key] = buildRPClaimPayload(value, claim, nil)
 			continue
 		}
 
@@ -1635,7 +1651,7 @@ func applyConfiguredIDTokenClaims(baseClaims map[string]any, metadata map[string
 	return baseClaims
 }
 
-func (h *AuthHandler) withRPProfileClaims(ctx context.Context, claims map[string]any, client domain.HydraClient, subject string) map[string]any {
+func (h *AuthHandler) withRPUserMetadataClaims(ctx context.Context, claims map[string]any, client domain.HydraClient, subject string) map[string]any {
 	if claims == nil {
 		claims = map[string]any{}
 	}
@@ -1649,8 +1665,8 @@ func (h *AuthHandler) withRPProfileClaims(ctx context.Context, claims map[string
 		return claims
 	}
 
-	claimKeys := extractClaimEnabledCustomUserSchemaKeys(client.Metadata)
-	if len(claimKeys) == 0 {
+	rpClaimDefinitions := extractRPClaimDefinitions(client.Metadata)
+	if len(rpClaimDefinitions) == 0 {
 		return claims
 	}
 
@@ -1659,94 +1675,239 @@ func (h *AuthHandler) withRPProfileClaims(ctx context.Context, claims map[string
 		return claims
 	}
 
-	fields := make(map[string]any)
-	for _, key := range claimKeys {
-		raw, ok := row.Metadata[key]
+	rpClaims, _ := claims["rp_claims"].(map[string]any)
+	if rpClaims == nil {
+		rpClaims = map[string]any{}
+	}
+
+	for _, claim := range rpClaimDefinitions {
+		if isReservedRPClaimKey(claim.Key) {
+			continue
+		}
+		raw, ok := row.Metadata[claim.Key]
 		if !ok || raw == nil {
 			continue
 		}
-		if value, ok := raw.(string); ok {
-			value = strings.TrimSpace(value)
-			if value == "" {
-				continue
-			}
-			fields[key] = value
+		value, ok := coerceRPUserMetadataClaimValue(raw, claim.ValueType)
+		if !ok {
+			slog.Warn("failed to coerce rp user metadata claim", "client_id", clientID, "subject", subject, "key", claim.Key, "value_type", claim.ValueType)
 			continue
 		}
-		fields[key] = raw
-	}
-	if len(fields) == 0 {
-		return claims
+		rpClaims[claim.Key] = buildRPClaimPayload(value, claim, row.Metadata[claim.Key+"_permissions"])
 	}
 
-	profile := map[string]any{
-		"client_id": clientID,
-		"fields":    fields,
+	if len(rpClaims) > 0 {
+		claims["rp_claims"] = rpClaims
 	}
-	if existing, ok := claims["rp_profiles"].([]any); ok {
-		claims["rp_profiles"] = append(existing, profile)
-		return claims
-	}
-	if existing, ok := claims["rp_profiles"].([]any); ok {
-		claims["rp_profiles"] = append(existing, profile)
-		return claims
-	}
-	claims["rp_profiles"] = []any{profile}
 	return claims
 }
 
-func extractClaimEnabledCustomUserSchemaKeys(metadata map[string]any) []string {
+func extractRPClaimDefinitions(metadata map[string]any) []normalizedIDTokenClaim {
 	if metadata == nil {
 		return nil
 	}
-	rawSchema, ok := metadata["customUserSchema"]
-	if !ok || rawSchema == nil {
+	rawClaims, ok := metadata[domain.MetadataIDTokenClaims]
+	if !ok || rawClaims == nil {
 		return nil
 	}
-
-	var items []any
-	switch schema := rawSchema.(type) {
-	case []any:
-		items = schema
-	case []map[string]any:
-		items = make([]any, 0, len(schema))
-		for _, item := range schema {
-			items = append(items, item)
+	normalizedClaims, err := normalizeIDTokenClaims(rawClaims)
+	if err != nil {
+		slog.Warn("failed to normalize rp claim definitions", "error", err)
+		return nil
+	}
+	definitions := make([]normalizedIDTokenClaim, 0, len(normalizedClaims))
+	seen := make(map[string]struct{}, len(normalizedClaims))
+	for _, claim := range normalizedClaims {
+		if claim.Namespace != "rp_claims" {
+			continue
 		}
+		if _, exists := seen[claim.Key]; exists {
+			continue
+		}
+		seen[claim.Key] = struct{}{}
+		definitions = append(definitions, claim)
+	}
+	return definitions
+}
+
+func isReservedTopLevelCustomClaimKey(key string) bool {
+	return strings.HasPrefix(strings.TrimSpace(key), "rp_")
+}
+
+func isReservedRPClaimKey(key string) bool {
+	key = strings.TrimSpace(key)
+	if strings.HasPrefix(key, "rp_") {
+		return true
+	}
+	switch key {
+	case "", "tenant_id", "tenants", "joined_tenants", "lead_tenants":
+		return true
 	default:
-		return nil
+		return false
+	}
+}
+
+func isReservedTenantTraitKey(key string) bool {
+	key = strings.TrimSpace(key)
+	if strings.HasPrefix(key, "rp_") {
+		return true
+	}
+	switch key {
+	case "metadata",
+		"global_custom_claims",
+		"global_custom_claim_types",
+		"global_custom_claim_permissions":
+		return true
+	default:
+		return false
+	}
+}
+
+func isRPClaimRelatedTenantMetadataKey(key string) bool {
+	return strings.HasPrefix(strings.TrimSpace(key), "rp_")
+}
+
+func sanitizeTenantClaimMetadata(raw map[string]any) map[string]any {
+	cleaned := make(map[string]any, len(raw))
+	for key, value := range raw {
+		if isRPClaimRelatedTenantMetadataKey(key) {
+			continue
+		}
+		cleaned[key] = sanitizeTenantClaimValue(value)
+	}
+	return cleaned
+}
+
+func sanitizeTenantClaimValue(value any) any {
+	switch typed := value.(type) {
+	case map[string]any:
+		return sanitizeTenantClaimMetadata(typed)
+	case []any:
+		items := make([]any, 0, len(typed))
+		for _, item := range typed {
+			items = append(items, sanitizeTenantClaimValue(item))
+		}
+		return items
+	default:
+		return value
+	}
+}
+
+func buildRPClaimPayload(value any, claim normalizedIDTokenClaim, rawPermission any) map[string]any {
+	readPermission := normalizeCustomClaimPermission(claim.ReadPermission)
+	writePermission := normalizeCustomClaimPermission(claim.WritePermission)
+
+	if permissions, ok := rawPermission.(map[string]any); ok {
+		if rawRead := readInterfaceString(permissions["readPermission"], ""); rawRead != "" {
+			readPermission = normalizeCustomClaimPermission(rawRead)
+		}
+		if rawWrite := readInterfaceString(permissions["writePermission"], ""); rawWrite != "" {
+			writePermission = normalizeCustomClaimPermission(rawWrite)
+		}
+	}
+	if writePermission == "user_and_admin" {
+		readPermission = "user_and_admin"
 	}
 
-	keys := make([]string, 0, len(items))
-	seen := make(map[string]struct{})
-	for _, item := range items {
-		field, ok := item.(map[string]any)
-		if !ok {
-			if typed, typedOK := item.(map[string]any); typedOK {
-				field = typed
-			} else {
-				continue
-			}
-		}
-		enabled, _ := field["claimEnabled"].(bool)
-		if !enabled {
-			enabled, _ = field["claim_enabled"].(bool)
-		}
-		if !enabled {
-			continue
-		}
-		key, _ := field["key"].(string)
-		key = strings.TrimSpace(key)
-		if key == "" {
-			continue
-		}
-		if _, exists := seen[key]; exists {
-			continue
-		}
-		seen[key] = struct{}{}
-		keys = append(keys, key)
+	return map[string]any{
+		"value":           value,
+		"readPermission":  readPermission,
+		"writePermission": writePermission,
 	}
-	return keys
+}
+
+func coerceRPUserMetadataClaimValue(raw any, valueType string) (any, bool) {
+	switch value := raw.(type) {
+	case string:
+		if strings.TrimSpace(value) == "" {
+			return nil, false
+		}
+		parsed, err := parseConfiguredClaimValue(value, valueType)
+		return parsed, err == nil
+	case []any:
+		if valueType == "array" {
+			return value, true
+		}
+	case []string:
+		if valueType == "array" {
+			items := make([]any, 0, len(value))
+			for _, item := range value {
+				items = append(items, item)
+			}
+			return items, true
+		}
+	case map[string]any:
+		if valueType == "object" {
+			return value, true
+		}
+	case bool:
+		if valueType == "boolean" {
+			return value, true
+		}
+	case float64:
+		if valueType == "date" || valueType == "datetime" {
+			if value == math.Trunc(value) {
+				return value, true
+			}
+			return nil, false
+		}
+		if valueType == "float" {
+			return value, true
+		}
+		if valueType == "number" && value == math.Trunc(value) {
+			return value, true
+		}
+	case float32:
+		floatValue := float64(value)
+		if valueType == "date" || valueType == "datetime" {
+			if floatValue == math.Trunc(floatValue) {
+				return floatValue, true
+			}
+			return nil, false
+		}
+		if valueType == "float" {
+			return floatValue, true
+		}
+		if valueType == "number" && floatValue == math.Trunc(floatValue) {
+			return floatValue, true
+		}
+	case int:
+		if valueType == "date" || valueType == "datetime" {
+			return float64(value), true
+		}
+		if valueType == "number" {
+			return float64(value), true
+		}
+		if valueType == "float" {
+			return float64(value), true
+		}
+	case int64:
+		if valueType == "date" || valueType == "datetime" {
+			return float64(value), true
+		}
+		if valueType == "number" {
+			return float64(value), true
+		}
+		if valueType == "float" {
+			return float64(value), true
+		}
+	case json.Number:
+		if valueType == "date" || valueType == "datetime" {
+			parsed, err := value.Int64()
+			return float64(parsed), err == nil
+		}
+		if valueType == "number" {
+			parsed, err := value.Int64()
+			return float64(parsed), err == nil
+		}
+		if valueType == "float" {
+			parsed, err := value.Float64()
+			return parsed, err == nil
+		}
+	}
+
+	parsed, err := parseConfiguredClaimValue(fmt.Sprint(raw), valueType)
+	return parsed, err == nil
 }
 
 func collectEmailList(traits map[string]any, primaryEmail string) []string {
@@ -6154,7 +6315,7 @@ func (h *AuthHandler) GetConsentRequest(c *fiber.Ctx) error {
 						currentSessionID,
 					)
 					sessionClaims = h.withHanmacFamilyTenantClaims(c.Context(), sessionClaims, identity.Traits, consentRequest.RequestedScope)
-					sessionClaims = h.withRPProfileClaims(c.Context(), sessionClaims, consentRequest.Client, consentRequest.Subject)
+					sessionClaims = h.withRPUserMetadataClaims(c.Context(), sessionClaims, consentRequest.Client, consentRequest.Subject)
 					acceptResp, err := h.Hydra.AcceptConsentRequest(c.Context(), challenge, consentRequest, sessionClaims)
 					if err == nil {
 						if err := h.emitRPUsageAuthorizationGranted(c, consentRequest, profile, currentSessionID, true, challenge); err != nil {
@@ -6192,7 +6353,7 @@ func (h *AuthHandler) GetConsentRequest(c *fiber.Ctx) error {
 				currentSessionID,
 			)
 			sessionClaims = h.withHanmacFamilyTenantClaims(c.Context(), sessionClaims, identity.Traits, consentRequest.RequestedScope)
-			sessionClaims = h.withRPProfileClaims(c.Context(), sessionClaims, consentRequest.Client, consentRequest.Subject)
+			sessionClaims = h.withRPUserMetadataClaims(c.Context(), sessionClaims, consentRequest.Client, consentRequest.Subject)
 
 			// [Debug] 실제 생성된 클레임 출력 (요청사항 확인용 - 자동 승인 시)
 			appEnv := strings.ToLower(os.Getenv("APP_ENV"))
@@ -6383,7 +6544,7 @@ func (h *AuthHandler) AcceptConsentRequest(c *fiber.Ctx) error {
 		currentSessionID,
 	)
 	sessionClaims = h.withHanmacFamilyTenantClaims(c.Context(), sessionClaims, identity.Traits, consentRequest.RequestedScope)
-	sessionClaims = h.withRPProfileClaims(c.Context(), sessionClaims, consentRequest.Client, consentRequest.Subject)
+	sessionClaims = h.withRPUserMetadataClaims(c.Context(), sessionClaims, consentRequest.Client, consentRequest.Subject)
 
 	// [Debug] 실제 생성된 클레임 출력 (요청사항 확인용)
 	appEnv := strings.ToLower(os.Getenv("APP_ENV"))
@@ -8388,7 +8549,7 @@ func buildHydraAuthorizationURL(clientID string, scopes []string, redirectURIs [
 	seen := map[string]struct{}{}
 	for _, scope := range append([]string{"openid"}, scopes...) {
 		scope = strings.TrimSpace(scope)
-		if scope == "" {
+		if scope == "" || isLegacyRefreshTokenScopeAlias(scope) {
 			continue
 		}
 		if _, ok := seen[scope]; ok {

backend/internal/handler/auth_handler_dynamic_claims_test.go

@@ -9,6 +9,7 @@ import (
 	"io"
 	"net/http"
 	"net/http/httptest"
+	"strings"
 	"testing"
 
 	"github.com/gofiber/fiber/v2"
@@ -511,7 +512,7 @@ func TestWithHanmacFamilyTenantClaims_DefaultClaimsOnlyWithoutTenantScope(t *tes
 	assert.NotContains(t, claims, "lead_tenants")
 }
 
-func TestAcceptConsentRequest_IncludesRPProfileClaims(t *testing.T) {
+func TestAcceptConsentRequest_DoesNotEmitLegacyProfileArray(t *testing.T) {
 	var capturedClaims map[string]any
 
 	transport := roundTripFunc(func(r *http.Request) (*http.Response, error) {
@@ -579,7 +580,7 @@ func TestAcceptConsentRequest_IncludesRPProfileClaims(t *testing.T) {
 			"approvalLevel": "A",
 			"internalMemo":  "관리자 전용",
 		},
-	}, nil).Once()
+	}, nil).Maybe()
 	h.RPUserMetadataRepo = repo
 
 	app := fiber.New()
@@ -597,14 +598,7 @@ func TestAcceptConsentRequest_IncludesRPProfileClaims(t *testing.T) {
 	assert.Equal(t, http.StatusOK, resp.StatusCode)
 
 	assert.NotNil(t, capturedClaims)
-	rpProfiles, ok := capturedClaims["rp_profiles"].([]any)
-	assert.True(t, ok)
-	assert.Len(t, rpProfiles, 1)
-	profile := rpProfiles[0].(map[string]any)
-	assert.Equal(t, "client-app", profile["client_id"])
-	fields := profile["fields"].(map[string]any)
-	assert.Equal(t, "A", fields["approvalLevel"])
-	assert.NotContains(t, fields, "internalMemo")
+	assert.NotContains(t, capturedClaims, legacyProfileArrayClaimKeyForTest())
 	repo.AssertExpectations(t)
 }
 
@@ -728,7 +722,7 @@ func TestAcceptConsentRequest_AppliesConfiguredIDTokenClaims(t *testing.T) {
 		if r.URL.Path == "/oauth2/auth/requests/consent" && r.URL.Query().Get("consent_challenge") == "challenge-configured-claims" {
 			return httpJSONAny(r, http.StatusOK, map[string]any{
 				"challenge":       "challenge-configured-claims",
-				"requested_scope": []string{"openid", "profile"},
+				"requested_scope": []string{"openid", "profile", "tenant"},
 				"subject":         "user-789",
 				"client": map[string]any{
 					"client_id": "client-configured-claims",
@@ -823,7 +817,233 @@ func TestAcceptConsentRequest_AppliesConfiguredIDTokenClaims(t *testing.T) {
 
 	rpClaims, ok := capturedClaims["rp_claims"].(map[string]any)
 	if assert.True(t, ok) {
-		assert.Equal(t, float64(2), rpClaims["tier"])
-		assert.Equal(t, []any{"sso", "claims"}, rpClaims["features"])
+		tier := rpClaims["tier"].(map[string]any)
+		assert.Equal(t, float64(2), tier["value"])
+		assert.Equal(t, "admin_only", tier["readPermission"])
+		assert.Equal(t, "admin_only", tier["writePermission"])
+
+		features := rpClaims["features"].(map[string]any)
+		assert.Equal(t, []any{"sso", "claims"}, features["value"])
+	}
+}
+
+func TestAcceptConsentRequest_UsesUpdatedRPUserMetadataForRPClaims(t *testing.T) {
+	var capturedClaims map[string]any
+
+	transport := roundTripFunc(func(r *http.Request) (*http.Response, error) {
+		if r.URL.Path == "/oauth2/auth/requests/consent" && r.URL.Query().Get("consent_challenge") == "challenge-rp-user-claims" {
+			return httpJSONAny(r, http.StatusOK, map[string]any{
+				"challenge":       "challenge-rp-user-claims",
+				"requested_scope": []string{"openid", "profile", "tenant"},
+				"subject":         "user-rp-claims",
+				"client": map[string]any{
+					"client_id": "client-rp-claims",
+					"metadata": map[string]any{
+						"id_token_claims": []map[string]any{
+							{
+								"namespace": "rp_claims",
+								"key":       "approvalLevel",
+								"value":     "A",
+								"valueType": "text",
+							},
+							{
+								"namespace": "rp_claims",
+								"key":       "activeMember",
+								"value":     "true",
+								"valueType": "boolean",
+							},
+							{
+								"namespace": "rp_claims",
+								"key":       "score",
+								"value":     "1",
+								"valueType": "number",
+							},
+							{
+								"namespace": "rp_claims",
+								"key":       "featureList",
+								"value":     `["default"]`,
+								"valueType": "array",
+							},
+							{
+								"namespace": "rp_claims",
+								"key":       "preferences",
+								"value":     `{"theme":"light","density":"comfortable"}`,
+								"valueType": "object",
+							},
+							{
+								"namespace": "rp_claims",
+								"key":       "contractDate",
+								"value":     "2026-06-09",
+								"valueType": "date",
+							},
+							{
+								"namespace": "rp_claims",
+								"key":       "approvedAt",
+								"value":     "2026-06-09T09:30",
+								"valueType": "datetime",
+							},
+							{
+								"namespace":       "rp_claims",
+								"key":             "tenants",
+								"value":           "must-not-shadow-tenants",
+								"valueType":       "text",
+								"readPermission":  "user_and_admin",
+								"writePermission": "user_and_admin",
+							},
+						},
+					},
+				},
+			}), nil
+		}
+		if r.URL.Path == "/oauth2/auth/requests/consent/accept" && r.URL.Query().Get("consent_challenge") == "challenge-rp-user-claims" {
+			body, _ := io.ReadAll(r.Body)
+			var acceptReq map[string]any
+			json.Unmarshal(body, &acceptReq)
+			if session, ok := acceptReq["session"].(map[string]any); ok {
+				capturedClaims = session["id_token"].(map[string]any)
+			}
+
+			return httpJSONAny(r, http.StatusOK, map[string]any{
+				"redirect_to": "http://rp/cb",
+			}), nil
+		}
+		return httpResponse(r, http.StatusNotFound, "not found"), nil
+	})
+
+	client := &http.Client{Transport: transport}
+	h := &AuthHandler{
+		Hydra: &service.HydraAdminService{
+			AdminURL:   "http://hydra.test",
+			HTTPClient: client,
+		},
+		KratosAdmin: new(MockKratosAdminService),
+	}
+	h.KratosAdmin.(*MockKratosAdminService).On("GetIdentity", mock.Anything, "user-rp-claims").Return(&service.KratosIdentity{
+		ID: "user-rp-claims",
+		Traits: map[string]any{
+			"email":     "rp-user@example.com",
+			"name":      "RP User",
+			"tenant_id": "tenant-leaf",
+			"tenant-leaf": map[string]any{
+				"department":       "Platform",
+				"rp_claims":        map[string]any{"mustNotLeak": true},
+				"rp_custom_claims": map[string]any{"client-rp-claims": map[string]any{"mustNotLeak": true}},
+			},
+			"rp_custom_claims": map[string]any{
+				"client-rp-claims": map[string]any{"approvalLevel": "B"},
+			},
+		},
+	}, nil)
+	rootTenantID := "tenant-root"
+	mockTenantSvc := new(MockTenantService)
+	mockTenantSvc.On("GetTenant", mock.Anything, "tenant-leaf").Return(&domain.Tenant{
+		ID:       "tenant-leaf",
+		Slug:     "platform",
+		Name:     "플랫폼팀",
+		Type:     domain.TenantTypeUserGroup,
+		ParentID: &rootTenantID,
+	}, nil)
+	mockTenantSvc.On("GetTenant", mock.Anything, rootTenantID).Return(&domain.Tenant{
+		ID:   rootTenantID,
+		Slug: "root",
+		Name: "루트",
+		Type: domain.TenantTypeCompany,
+	}, nil)
+	mockTenantSvc.On("ListJoinedTenants", mock.Anything, "user-rp-claims").Return([]domain.Tenant{}, nil)
+	h.TenantService = mockTenantSvc
+	repo := new(devMockRPUserMetadataRepo)
+	repo.On("Get", mock.Anything, "client-rp-claims", "user-rp-claims").Return(&domain.RPUserMetadata{
+		ClientID: "client-rp-claims",
+		UserID:   "user-rp-claims",
+		Metadata: domain.JSONMap{
+			"approvalLevel": "B",
+			"activeMember":  false,
+			"score":         float64(42),
+			"featureList":   []any{"sso", "claims"},
+			"preferences": map[string]any{
+				"theme":   "dark",
+				"density": "compact",
+			},
+			"contractDate": float64(1781017200),
+			"approvedAt":   float64(1780968600),
+			"internalMemo": "must-not-leak",
+			"approvalLevel_permissions": map[string]any{
+				"readPermission":  "admin_only",
+				"writePermission": "user_and_admin",
+			},
+		},
+	}, nil).Once()
+	h.RPUserMetadataRepo = repo
+
+	app := fiber.New()
+	app.Post("/api/v1/auth/consent/accept", h.AcceptConsentRequest)
+
+	reqBody, _ := json.Marshal(map[string]any{
+		"consent_challenge": "challenge-rp-user-claims",
+		"grant_scope":       []string{"openid", "profile", "tenant"},
+	})
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/auth/consent/accept", bytes.NewReader(reqBody))
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := app.Test(req)
+	assert.NoError(t, err)
+	assert.Equal(t, http.StatusOK, resp.StatusCode)
+
+	assert.NotNil(t, capturedClaims)
+	rpClaims, ok := capturedClaims["rp_claims"].(map[string]any)
+	if assert.True(t, ok) {
+		approvalLevel := rpClaims["approvalLevel"].(map[string]any)
+		assert.Equal(t, "B", approvalLevel["value"])
+		assert.Equal(t, "user_and_admin", approvalLevel["readPermission"])
+		assert.Equal(t, "user_and_admin", approvalLevel["writePermission"])
+
+		activeMember := rpClaims["activeMember"].(map[string]any)
+		assert.Equal(t, false, activeMember["value"])
+
+		score := rpClaims["score"].(map[string]any)
+		assert.Equal(t, float64(42), score["value"])
+
+		featureList := rpClaims["featureList"].(map[string]any)
+		assert.Equal(t, []any{"sso", "claims"}, featureList["value"])
+
+		preferences := rpClaims["preferences"].(map[string]any)
+		assert.Equal(t, map[string]any{"theme": "dark", "density": "compact"}, preferences["value"])
+
+		contractDate := rpClaims["contractDate"].(map[string]any)
+		assert.Equal(t, float64(1781017200), contractDate["value"])
+
+		approvedAt := rpClaims["approvedAt"].(map[string]any)
+		assert.Equal(t, float64(1780968600), approvedAt["value"])
+
+		assert.NotContains(t, rpClaims, "tenants")
+		assert.NotContains(t, rpClaims, "internalMemo")
+		assert.NotContains(t, rpClaims, "approvalLevel_permissions")
+	}
+	assert.NotContains(t, capturedClaims["joined_tenants"], "rp_custom_claims")
+	tenants := capturedClaims["tenants"].(map[string]any)
+	assert.Contains(t, tenants, "tenant-leaf")
+	assert.NotEqual(t, "must-not-shadow-tenants", capturedClaims["tenants"])
+	assertNoRPClaimDataInTenantClaims(t, tenants)
+	assert.NotContains(t, capturedClaims, legacyProfileArrayClaimKeyForTest())
+	repo.AssertExpectations(t)
+}
+
+func legacyProfileArrayClaimKeyForTest() string {
+	return strings.Join([]string{"rp", "profiles"}, "_")
+}
+
+func assertNoRPClaimDataInTenantClaims(t *testing.T, value any) {
+	t.Helper()
+
+	switch typed := value.(type) {
+	case map[string]any:
+		for key, child := range typed {
+			assert.False(t, strings.HasPrefix(key, "rp_"))
+			assertNoRPClaimDataInTenantClaims(t, child)
+		}
+	case []any:
+		for _, child := range typed {
+			assertNoRPClaimDataInTenantClaims(t, child)
+		}
 	}
 }

backend/internal/handler/auth_handler_link_test.go

@@ -3,7 +3,6 @@ package handler
 import (
 	"baron-sso-backend/internal/domain"
 	"baron-sso-backend/internal/service"
-	"baron-sso-backend/internal/testsupport"
 	"bytes"
 	"encoding/json"
 	"io"
@@ -50,35 +49,37 @@ func newHeadlessLinkTestApp(h *AuthHandler) *fiber.App {
 	return app
 }
 
-func newKratosWhoamiTestServer(t *testing.T, identityID string) *httptest.Server {
+func newKratosWhoamiTestServer(t *testing.T, identityID string) string {
 	t.Helper()
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.Path != "/sessions/whoami" {
-			http.NotFound(w, r)
-			return
-		}
-		if r.Header.Get("Cookie") == "" && r.Header.Get("X-Session-Token") == "" {
-			http.Error(w, "missing session", http.StatusUnauthorized)
-			return
-		}
-		_ = json.NewEncoder(w).Encode(map[string]any{
-			"id":               "session-123",
-			"authenticated_at": "2026-05-21T00:00:00Z",
-			"identity": map[string]any{
-				"id": identityID,
-				"traits": map[string]any{
-					"email": "user@example.com",
-				},
-			},
-		})
-	}))
 	origDefaultClient := http.DefaultClient
-	http.DefaultClient = server.Client()
+	http.DefaultClient = &http.Client{
+		Transport: roundTripFunc(func(r *http.Request) (*http.Response, error) {
+			if r.URL.Path != "/sessions/whoami" {
+				return httpResponse(r, http.StatusNotFound, "not found"), nil
+			}
+			if r.Header.Get("Cookie") == "" && r.Header.Get("X-Session-Token") == "" {
+				return httpResponse(r, http.StatusUnauthorized, "missing session"), nil
+			}
+			body, err := json.Marshal(map[string]any{
+				"id":               "session-123",
+				"authenticated_at": "2026-05-21T00:00:00Z",
+				"identity": map[string]any{
+					"id": identityID,
+					"traits": map[string]any{
+						"email": "user@example.com",
+					},
+				},
+			})
+			if err != nil {
+				return nil, err
+			}
+			return httpResponse(r, http.StatusOK, string(body)), nil
+		}),
+	}
 	t.Cleanup(func() {
 		http.DefaultClient = origDefaultClient
 	})
-	t.Cleanup(server.Close)
-	return server
+	return "http://kratos.test"
 }
 
 func TestEnchantedLinkFlow_Email_Success(t *testing.T) {
@@ -215,8 +216,7 @@ func TestVerifyMagicLink_VerifyOnlySharedBrowserSameSubjectApprovesOnly(t *testi
 	redis := &mockRedisRepo{data: map[string]string{
 		prefixToken + "token-123": `{"pendingRef":"pending-123","loginId":"user@example.com"}`,
 	}}
-	kratosPublic := newKratosWhoamiTestServer(t, "kratos-user-1")
-	t.Setenv("KRATOS_PUBLIC_URL", kratosPublic.URL)
+	t.Setenv("KRATOS_PUBLIC_URL", newKratosWhoamiTestServer(t, "kratos-user-1"))
 
 	h := &AuthHandler{
 		RedisService: redis,
@@ -248,8 +248,7 @@ func TestVerifyMagicLink_VerifyOnlySharedBrowserDifferentSubjectApprovesOnly(t *
 	redis := &mockRedisRepo{data: map[string]string{
 		prefixToken + "token-123": `{"pendingRef":"pending-123","loginId":"user@example.com"}`,
 	}}
-	kratosPublic := newKratosWhoamiTestServer(t, "kratos-other-user")
-	t.Setenv("KRATOS_PUBLIC_URL", kratosPublic.URL)
+	t.Setenv("KRATOS_PUBLIC_URL", newKratosWhoamiTestServer(t, "kratos-other-user"))
 
 	h := &AuthHandler{
 		RedisService: redis,
@@ -302,8 +301,7 @@ func TestVerifyLoginCode_VerifyOnlySharedBrowserDifferentSubjectApprovesOnly(t *
 		prefixLoginCodePending + "user@example.com": "pending-123",
 		prefixLoginCodeValue + "pending-123":        "569765",
 	}}
-	kratosPublic := newKratosWhoamiTestServer(t, "kratos-other-user")
-	t.Setenv("KRATOS_PUBLIC_URL", kratosPublic.URL)
+	t.Setenv("KRATOS_PUBLIC_URL", newKratosWhoamiTestServer(t, "kratos-other-user"))
 
 	h := &AuthHandler{
 		RedisService: redis,
@@ -393,8 +391,7 @@ func TestPollEnchantedLink_SharedBrowserSameSubjectIssuesSession(t *testing.T) {
 	redis := &mockRedisRepo{data: map[string]string{
 		prefixSession + "pending-123": `{"status":"approved","loginId":"user@example.com"}`,
 	}}
-	kratosPublic := newKratosWhoamiTestServer(t, "kratos-user-1")
-	t.Setenv("KRATOS_PUBLIC_URL", kratosPublic.URL)
+	t.Setenv("KRATOS_PUBLIC_URL", newKratosWhoamiTestServer(t, "kratos-user-1"))
 
 	h := &AuthHandler{
 		RedisService: redis,
@@ -425,8 +422,7 @@ func TestPollEnchantedLink_SharedBrowserDifferentSubjectConflicts(t *testing.T)
 	redis := &mockRedisRepo{data: map[string]string{
 		prefixSession + "pending-123": `{"status":"approved","loginId":"user@example.com"}`,
 	}}
-	kratosPublic := newKratosWhoamiTestServer(t, "kratos-other-user")
-	t.Setenv("KRATOS_PUBLIC_URL", kratosPublic.URL)
+	t.Setenv("KRATOS_PUBLIC_URL", newKratosWhoamiTestServer(t, "kratos-other-user"))
 
 	h := &AuthHandler{
 		RedisService: redis,
@@ -456,18 +452,11 @@ func TestPollEnchantedLink_SharedBrowserDifferentSubjectConflicts(t *testing.T)
 func TestHeadlessLinkInit_HeadlessLoginClientSuccess(t *testing.T) {
 	t.Setenv("BACKEND_PUBLIC_URL", "")
 
-	if !testsupport.PortBindingAvailable() {
-		t.Skip("skipping headless link tests because this environment cannot bind local TCP listeners")
-	}
-
 	redis := &mockRedisRepo{data: make(map[string]string)}
 	privateKey, jwks := mustHeadlessRSAJWK(t)
 	jwksBody, _ := json.Marshal(jwks)
-	jwksServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-		_, _ = w.Write(jwksBody)
-	}))
-	defer jwksServer.Close()
+	jwksClient := newJWKSHTTPClient(t, jwksBody)
+	jwksURI := jwksURL()
 
 	idp := &mockIdpProvider{
 		userExists:      true,
@@ -485,7 +474,7 @@ func TestHeadlessLinkInit_HeadlessLoginClientSuccess(t *testing.T) {
 						"status":                              "active",
 						"headless_login_enabled":              true,
 						"headless_token_endpoint_auth_method": "private_key_jwt",
-						"headless_jwks_uri":                   jwksServer.URL + "/.well-known/jwks.json",
+						"headless_jwks_uri":                   jwksURI,
 					},
 				},
 			})
@@ -497,6 +486,7 @@ func TestHeadlessLinkInit_HeadlessLoginClientSuccess(t *testing.T) {
 	h := &AuthHandler{
 		RedisService: redis,
 		IdpProvider:  idp,
+		HeadlessJWKS: service.NewHeadlessJWKSCacheService(nil, jwksClient),
 		SmsService:   &mockSmsService{},
 		Hydra: &service.HydraAdminService{
 			AdminURL:   "http://hydra.test",
@@ -529,10 +519,6 @@ func TestHeadlessLinkInit_HeadlessLoginClientSuccess(t *testing.T) {
 func TestHeadlessLinkPoll_AfterApprovalReturnsRedirect(t *testing.T) {
 	t.Setenv("BACKEND_PUBLIC_URL", "")
 
-	if !testsupport.PortBindingAvailable() {
-		t.Skip("skipping headless link tests because this environment cannot bind local TCP listeners")
-	}
-
 	redis := &mockRedisRepo{data: make(map[string]string)}
 	privateKey, jwks := mustHeadlessRSAJWK(t)
 	jwksBody, _ := json.Marshal(jwks)
@@ -659,10 +645,6 @@ func TestHeadlessLinkPoll_AfterApprovalReturnsRedirect(t *testing.T) {
 func TestHeadlessLinkPoll_ApproverSubjectConflictBlocksMixedRP(t *testing.T) {
 	t.Setenv("BACKEND_PUBLIC_URL", "")
 
-	if !testsupport.PortBindingAvailable() {
-		t.Skip("skipping headless link tests because this environment cannot bind local TCP listeners")
-	}
-
 	redis := &mockRedisRepo{data: make(map[string]string)}
 	privateKey, jwks := mustHeadlessRSAJWK(t)
 	jwksBody, _ := json.Marshal(jwks)
@@ -748,8 +730,7 @@ func TestHeadlessLinkPoll_ApproverSubjectConflictBlocksMixedRP(t *testing.T) {
 	}
 	assert.NotEmpty(t, token)
 
-	kratosPublic := newKratosWhoamiTestServer(t, "kratos-userfront-a")
-	t.Setenv("KRATOS_PUBLIC_URL", kratosPublic.URL)
+	t.Setenv("KRATOS_PUBLIC_URL", newKratosWhoamiTestServer(t, "kratos-userfront-a"))
 
 	verifyBody, _ := json.Marshal(map[string]any{
 		"token":      token,
@@ -785,10 +766,6 @@ func TestHeadlessLinkPoll_ApproverSubjectConflictBlocksMixedRP(t *testing.T) {
 func TestHeadlessLinkPoll_RequestCookieSubjectConflictBlocksMixedRP(t *testing.T) {
 	t.Setenv("BACKEND_PUBLIC_URL", "")
 
-	if !testsupport.PortBindingAvailable() {
-		t.Skip("skipping headless link tests because this environment cannot bind local TCP listeners")
-	}
-
 	redis := &mockRedisRepo{data: make(map[string]string)}
 	privateKey, jwks := mustHeadlessRSAJWK(t)
 	jwksBody, _ := json.Marshal(jwks)
@@ -880,8 +857,7 @@ func TestHeadlessLinkPoll_RequestCookieSubjectConflictBlocksMixedRP(t *testing.T
 	resp, _ = app.Test(req, -1)
 	assert.Equal(t, http.StatusOK, resp.StatusCode)
 
-	kratosPublic := newKratosWhoamiTestServer(t, "kratos-userfront-a")
-	t.Setenv("KRATOS_PUBLIC_URL", kratosPublic.URL)
+	t.Setenv("KRATOS_PUBLIC_URL", newKratosWhoamiTestServer(t, "kratos-userfront-a"))
 
 	pollBody, _ := json.Marshal(map[string]string{
 		"client_id":        "headless-login-client",

backend/internal/handler/auth_handler_login_test.go

@@ -9,7 +9,6 @@ import (
 	"baron-sso-backend/internal/domain"
 	"baron-sso-backend/internal/middleware"
 	"baron-sso-backend/internal/service"
-	"baron-sso-backend/internal/testsupport"
 	"bytes"
 	"context"
 	"crypto/ecdsa"
@@ -446,10 +445,6 @@ func runHeadlessPasswordLoginWithAssertionRequest(
 	headers map[string]string,
 ) *http.Response {
 	t.Helper()
-	if !testsupport.PortBindingAvailable() {
-		t.Skip("skipping headless login tests because this environment cannot bind local TCP listeners")
-	}
-
 	mockIdp := new(MockIdentityProvider)
 	mockIdp.On("SignIn", "employee001", "password").Return(&domain.AuthInfo{
 		SessionToken: &domain.Token{JWT: "valid-jwt"},
@@ -463,11 +458,8 @@ func runHeadlessPasswordLoginWithAssertionRequest(
 	if err != nil {
 		t.Fatalf("failed to marshal jwks body: %v", err)
 	}
-	jwksServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-		_, _ = w.Write(jwksBody)
-	}))
-	t.Cleanup(jwksServer.Close)
+	jwksClient := newJWKSHTTPClient(t, jwksBody)
+	jwksURI := jwksURL()
 
 	hydraHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		switch {
@@ -481,7 +473,7 @@ func runHeadlessPasswordLoginWithAssertionRequest(
 						"status":                              "active",
 						"headless_login_enabled":              true,
 						"headless_token_endpoint_auth_method": "private_key_jwt",
-						"headless_jwks_uri":                   jwksServer.URL + "/.well-known/jwks.json",
+						"headless_jwks_uri":                   jwksURI,
 					},
 				},
 			})
@@ -494,8 +486,9 @@ func runHeadlessPasswordLoginWithAssertionRequest(
 	})
 
 	h := &AuthHandler{
-		IdpProvider: mockIdp,
-		KratosAdmin: mockKratos,
+		IdpProvider:  mockIdp,
+		KratosAdmin:  mockKratos,
+		HeadlessJWKS: service.NewHeadlessJWKSCacheService(nil, jwksClient),
 		Hydra: &service.HydraAdminService{
 			AdminURL:   "http://hydra.test",
 			HTTPClient: &http.Client{Transport: mockHydraTransport(hydraHandler)},
@@ -551,10 +544,6 @@ func runHeadlessPasswordLoginWithAssertionAndLoggerRequest(
 	logger *slog.Logger,
 ) *http.Response {
 	t.Helper()
-	if !testsupport.PortBindingAvailable() {
-		t.Skip("skipping headless login tests because this environment cannot bind local TCP listeners")
-	}
-
 	mockIdp := new(MockIdentityProvider)
 	mockIdp.On("SignIn", "employee001", "password").Return(&domain.AuthInfo{
 		SessionToken: &domain.Token{JWT: "valid-jwt"},
@@ -568,11 +557,8 @@ func runHeadlessPasswordLoginWithAssertionAndLoggerRequest(
 	if err != nil {
 		t.Fatalf("failed to marshal jwks body: %v", err)
 	}
-	jwksServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-		_, _ = w.Write(jwksBody)
-	}))
-	t.Cleanup(jwksServer.Close)
+	jwksClient := newJWKSHTTPClient(t, jwksBody)
+	jwksURI := jwksURL()
 
 	hydraHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		switch {
@@ -586,7 +572,7 @@ func runHeadlessPasswordLoginWithAssertionAndLoggerRequest(
 						"status":                              "active",
 						"headless_login_enabled":              true,
 						"headless_token_endpoint_auth_method": "private_key_jwt",
-						"headless_jwks_uri":                   jwksServer.URL + "/.well-known/jwks.json",
+						"headless_jwks_uri":                   jwksURI,
 					},
 				},
 			})
@@ -599,8 +585,9 @@ func runHeadlessPasswordLoginWithAssertionAndLoggerRequest(
 	})
 
 	h := &AuthHandler{
-		IdpProvider: mockIdp,
-		KratosAdmin: mockKratos,
+		IdpProvider:  mockIdp,
+		KratosAdmin:  mockKratos,
+		HeadlessJWKS: service.NewHeadlessJWKSCacheService(nil, jwksClient),
 		Hydra: &service.HydraAdminService{
 			AdminURL:   "http://hydra.test",
 			HTTPClient: &http.Client{Transport: mockHydraTransport(hydraHandler)},
@@ -879,10 +866,6 @@ func TestPasswordLogin_UserFront_AuditIncludesDefaultClientMetadata(t *testing.T
 func TestHeadlessPasswordLogin_HeadlessLoginClientSuccess(t *testing.T) {
 	t.Setenv("BACKEND_PUBLIC_URL", "")
 
-	if !testsupport.PortBindingAvailable() {
-		t.Skip("skipping headless login tests because this environment cannot bind local TCP listeners")
-	}
-
 	mockIdp := new(MockIdentityProvider)
 	mockIdp.On("SignIn", "employee001", "password").Return(&domain.AuthInfo{
 		SessionToken: &domain.Token{JWT: "valid-jwt"},
@@ -891,11 +874,8 @@ func TestHeadlessPasswordLogin_HeadlessLoginClientSuccess(t *testing.T) {
 
 	privateKey, jwks := mustHeadlessRSAJWK(t)
 	jwksBody, _ := json.Marshal(jwks)
-	jwksServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-		_, _ = w.Write(jwksBody)
-	}))
-	defer jwksServer.Close()
+	jwksClient := newJWKSHTTPClient(t, jwksBody)
+	jwksURI := jwksURL()
 
 	hydraHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		switch {
@@ -909,7 +889,7 @@ func TestHeadlessPasswordLogin_HeadlessLoginClientSuccess(t *testing.T) {
 						"status":                              "active",
 						"headless_login_enabled":              true,
 						"headless_token_endpoint_auth_method": "private_key_jwt",
-						"headless_jwks_uri":                   jwksServer.URL + "/.well-known/jwks.json",
+						"headless_jwks_uri":                   jwksURI,
 					},
 				},
 			})
@@ -924,8 +904,9 @@ func TestHeadlessPasswordLogin_HeadlessLoginClientSuccess(t *testing.T) {
 	mockKratos.On("FindIdentityIDByIdentifier", mock.Anything, "employee001").Return("kratos-identity-id", nil)
 
 	h := &AuthHandler{
-		IdpProvider: mockIdp,
-		KratosAdmin: mockKratos,
+		IdpProvider:  mockIdp,
+		KratosAdmin:  mockKratos,
+		HeadlessJWKS: service.NewHeadlessJWKSCacheService(nil, jwksClient),
 		Hydra: &service.HydraAdminService{
 			AdminURL:   "http://hydra.test",
 			HTTPClient: &http.Client{Transport: mockHydraTransport(hydraHandler)},
@@ -979,10 +960,6 @@ func TestHeadlessPasswordLogin_HeadlessLoginClientSuccess(t *testing.T) {
 func TestHeadlessPasswordLogin_OIDCSubjectConflictBlocksMixedRP(t *testing.T) {
 	t.Setenv("BACKEND_PUBLIC_URL", "")
 
-	if !testsupport.PortBindingAvailable() {
-		t.Skip("skipping headless login tests because this environment cannot bind local TCP listeners")
-	}
-
 	mockIdp := new(MockIdentityProvider)
 	mockIdp.On("SignIn", "employee002", "password").Return(&domain.AuthInfo{
 		SessionToken: &domain.Token{JWT: "valid-jwt"},
@@ -991,11 +968,8 @@ func TestHeadlessPasswordLogin_OIDCSubjectConflictBlocksMixedRP(t *testing.T) {
 
 	privateKey, jwks := mustHeadlessRSAJWK(t)
 	jwksBody, _ := json.Marshal(jwks)
-	jwksServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-		_, _ = w.Write(jwksBody)
-	}))
-	defer jwksServer.Close()
+	jwksClient := newJWKSHTTPClient(t, jwksBody)
+	jwksURI := jwksURL()
 
 	acceptCalled := false
 	hydraHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -1012,7 +986,7 @@ func TestHeadlessPasswordLogin_OIDCSubjectConflictBlocksMixedRP(t *testing.T) {
 						"status":                              "active",
 						"headless_login_enabled":              true,
 						"headless_token_endpoint_auth_method": "private_key_jwt",
-						"headless_jwks_uri":                   jwksServer.URL + "/.well-known/jwks.json",
+						"headless_jwks_uri":                   jwksURI,
 					},
 				},
 			})
@@ -1028,8 +1002,9 @@ func TestHeadlessPasswordLogin_OIDCSubjectConflictBlocksMixedRP(t *testing.T) {
 	mockKratos.On("FindIdentityIDByIdentifier", mock.Anything, "employee002").Return("kratos-target-b", nil)
 
 	h := &AuthHandler{
-		IdpProvider: mockIdp,
-		KratosAdmin: mockKratos,
+		IdpProvider:  mockIdp,
+		KratosAdmin:  mockKratos,
+		HeadlessJWKS: service.NewHeadlessJWKSCacheService(nil, jwksClient),
 		Hydra: &service.HydraAdminService{
 			AdminURL:   "http://hydra.test",
 			HTTPClient: &http.Client{Transport: mockHydraTransport(hydraHandler)},
@@ -1065,10 +1040,6 @@ func TestHeadlessPasswordLogin_OIDCSubjectConflictBlocksMixedRP(t *testing.T) {
 func TestHeadlessPasswordLogin_OIDCSubjectSameAllowsMixedRP(t *testing.T) {
 	t.Setenv("BACKEND_PUBLIC_URL", "")
 
-	if !testsupport.PortBindingAvailable() {
-		t.Skip("skipping headless login tests because this environment cannot bind local TCP listeners")
-	}
-
 	mockIdp := new(MockIdentityProvider)
 	mockIdp.On("SignIn", "employee001", "password").Return(&domain.AuthInfo{
 		SessionToken: &domain.Token{JWT: "valid-jwt"},
@@ -1077,11 +1048,8 @@ func TestHeadlessPasswordLogin_OIDCSubjectSameAllowsMixedRP(t *testing.T) {
 
 	privateKey, jwks := mustHeadlessRSAJWK(t)
 	jwksBody, _ := json.Marshal(jwks)
-	jwksServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-		_, _ = w.Write(jwksBody)
-	}))
-	defer jwksServer.Close()
+	jwksClient := newJWKSHTTPClient(t, jwksBody)
+	jwksURI := jwksURL()
 
 	hydraHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		switch {
@@ -1097,7 +1065,7 @@ func TestHeadlessPasswordLogin_OIDCSubjectSameAllowsMixedRP(t *testing.T) {
 						"status":                              "active",
 						"headless_login_enabled":              true,
 						"headless_token_endpoint_auth_method": "private_key_jwt",
-						"headless_jwks_uri":                   jwksServer.URL + "/.well-known/jwks.json",
+						"headless_jwks_uri":                   jwksURI,
 					},
 				},
 			})
@@ -1112,8 +1080,9 @@ func TestHeadlessPasswordLogin_OIDCSubjectSameAllowsMixedRP(t *testing.T) {
 	mockKratos.On("FindIdentityIDByIdentifier", mock.Anything, "employee001").Return("kratos-userfront-a", nil)
 
 	h := &AuthHandler{
-		IdpProvider: mockIdp,
-		KratosAdmin: mockKratos,
+		IdpProvider:  mockIdp,
+		KratosAdmin:  mockKratos,
+		HeadlessJWKS: service.NewHeadlessJWKSCacheService(nil, jwksClient),
 		Hydra: &service.HydraAdminService{
 			AdminURL:   "http://hydra.test",
 			HTTPClient: &http.Client{Transport: mockHydraTransport(hydraHandler)},
@@ -1271,10 +1240,6 @@ func TestHeadlessPasswordLogin_AuditIncludesClientMetadata(t *testing.T) {
 func TestHeadlessPasswordLogin_IgnoresInlineHeadlessJWKSWhenJWKSURIIsConfigured(t *testing.T) {
 	t.Setenv("BACKEND_PUBLIC_URL", "")
 
-	if !testsupport.PortBindingAvailable() {
-		t.Skip("skipping headless login tests because this environment cannot bind local TCP listeners")
-	}
-
 	mockIdp := new(MockIdentityProvider)
 	mockIdp.On("SignIn", "employee001", "password").Return(&domain.AuthInfo{
 		SessionToken: &domain.Token{JWT: "valid-jwt"},
@@ -1283,11 +1248,8 @@ func TestHeadlessPasswordLogin_IgnoresInlineHeadlessJWKSWhenJWKSURIIsConfigured(
 
 	privateKey, jwks := mustHeadlessRSAJWK(t)
 	jwksBody, _ := json.Marshal(jwks)
-	jwksServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-		_, _ = w.Write(jwksBody)
-	}))
-	defer jwksServer.Close()
+	jwksClient := newJWKSHTTPClient(t, jwksBody)
+	jwksURI := jwksURL()
 
 	hydraHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		switch {
@@ -1301,7 +1263,7 @@ func TestHeadlessPasswordLogin_IgnoresInlineHeadlessJWKSWhenJWKSURIIsConfigured(
 						"status":                              "active",
 						"headless_login_enabled":              true,
 						"headless_token_endpoint_auth_method": "private_key_jwt",
-						"headless_jwks_uri":                   jwksServer.URL + "/.well-known/jwks.json",
+						"headless_jwks_uri":                   jwksURI,
 						"headless_jwks": map[string]any{
 							"keys": []map[string]any{},
 						},
@@ -1319,8 +1281,9 @@ func TestHeadlessPasswordLogin_IgnoresInlineHeadlessJWKSWhenJWKSURIIsConfigured(
 	mockKratos.On("FindIdentityIDByIdentifier", mock.Anything, "employee001").Return("kratos-identity-id", nil)
 
 	h := &AuthHandler{
-		IdpProvider: mockIdp,
-		KratosAdmin: mockKratos,
+		IdpProvider:  mockIdp,
+		KratosAdmin:  mockKratos,
+		HeadlessJWKS: service.NewHeadlessJWKSCacheService(nil, jwksClient),
 		Hydra: &service.HydraAdminService{
 			AdminURL:   "http://hydra.test",
 			HTTPClient: &http.Client{Transport: mockHydraTransport(hydraHandler)},
@@ -1360,10 +1323,6 @@ func TestHeadlessPasswordLogin_IgnoresInlineHeadlessJWKSWhenJWKSURIIsConfigured(
 func TestHeadlessPasswordLogin_RefreshesJWKSWhenSignatureFailsForCachedKid(t *testing.T) {
 	t.Setenv("BACKEND_PUBLIC_URL", "")
 
-	if !testsupport.PortBindingAvailable() {
-		t.Skip("skipping headless login tests because this environment cannot bind local TCP listeners")
-	}
-
 	mockIdp := new(MockIdentityProvider)
 	mockIdp.On("SignIn", "employee001", "password").Return(&domain.AuthInfo{
 		SessionToken: &domain.Token{JWT: "valid-jwt"},
@@ -1383,12 +1342,11 @@ func TestHeadlessPasswordLogin_RefreshesJWKSWhenSignatureFailsForCachedKid(t *te
 	}
 
 	fetchCount := 0
-	jwksServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	jwksClient := &http.Client{Transport: roundTripFunc(func(r *http.Request) (*http.Response, error) {
 		fetchCount++
-		w.Header().Set("Content-Type", "application/json")
-		_, _ = w.Write(freshRaw)
-	}))
-	defer jwksServer.Close()
+		return httpResponse(r, http.StatusOK, string(freshRaw)), nil
+	})}
+	jwksURI := jwksURL()
 
 	hydraHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		switch {
@@ -1402,7 +1360,7 @@ func TestHeadlessPasswordLogin_RefreshesJWKSWhenSignatureFailsForCachedKid(t *te
 						"status":                              "active",
 						"headless_login_enabled":              true,
 						"headless_token_endpoint_auth_method": "private_key_jwt",
-						"headless_jwks_uri":                   jwksServer.URL + "/.well-known/jwks.json",
+						"headless_jwks_uri":                   jwksURI,
 					},
 				},
 			})
@@ -1417,12 +1375,12 @@ func TestHeadlessPasswordLogin_RefreshesJWKSWhenSignatureFailsForCachedKid(t *te
 	mockKratos.On("FindIdentityIDByIdentifier", mock.Anything, "employee001").Return("kratos-identity-id", nil)
 
 	redisRepo := &testRedisRepo{values: map[string]string{}}
-	cacheService := service.NewHeadlessJWKSCacheService(redisRepo, jwksServer.Client())
+	cacheService := service.NewHeadlessJWKSCacheService(redisRepo, jwksClient)
 	now := time.Now()
 	expiresAt := now.Add(30 * time.Minute)
 	if err := cacheService.SaveState("headless-login-client", domain.HeadlessJWKSCacheState{
 		ClientID:          "headless-login-client",
-		JWKSURI:           jwksServer.URL + "/.well-known/jwks.json",
+		JWKSURI:           jwksURI,
 		RawJWKS:           string(staleRaw),
 		CachedKids:        []string{"test-kid"},
 		CachedAt:          &now,
@@ -1546,10 +1504,6 @@ func TestHeadlessPasswordLogin_MissingClientAssertionRejected(t *testing.T) {
 }
 
 func TestHeadlessPasswordLogin_InvalidClientAssertionRejected(t *testing.T) {
-	if !testsupport.PortBindingAvailable() {
-		t.Skip("skipping headless login tests because this environment cannot bind local TCP listeners")
-	}
-
 	mockIdp := new(MockIdentityProvider)
 	mockIdp.On("SignIn", "employee001", "password").Return(&domain.AuthInfo{
 		SessionToken: &domain.Token{JWT: "valid-jwt"},
@@ -1562,11 +1516,8 @@ func TestHeadlessPasswordLogin_InvalidClientAssertionRejected(t *testing.T) {
 	invalidKey, _ := mustHeadlessRSAJWK(t)
 	_ = validKey
 	jwksBody, _ := json.Marshal(jwks)
-	jwksServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-		_, _ = w.Write(jwksBody)
-	}))
-	defer jwksServer.Close()
+	jwksClient := newJWKSHTTPClient(t, jwksBody)
+	jwksURI := jwksURL()
 
 	hydraHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		switch {
@@ -1580,7 +1531,7 @@ func TestHeadlessPasswordLogin_InvalidClientAssertionRejected(t *testing.T) {
 						"status":                              "active",
 						"headless_login_enabled":              true,
 						"headless_token_endpoint_auth_method": "private_key_jwt",
-						"headless_jwks_uri":                   jwksServer.URL + "/.well-known/jwks.json",
+						"headless_jwks_uri":                   jwksURI,
 					},
 				},
 			})
@@ -1593,8 +1544,9 @@ func TestHeadlessPasswordLogin_InvalidClientAssertionRejected(t *testing.T) {
 	})
 
 	h := &AuthHandler{
-		IdpProvider: mockIdp,
-		KratosAdmin: mockKratos,
+		IdpProvider:  mockIdp,
+		KratosAdmin:  mockKratos,
+		HeadlessJWKS: service.NewHeadlessJWKSCacheService(nil, jwksClient),
 		Hydra: &service.HydraAdminService{
 			AdminURL:   "http://hydra.test",
 			HTTPClient: &http.Client{Transport: mockHydraTransport(hydraHandler)},
@@ -2198,8 +2150,7 @@ func TestPasswordLogin_SharedBrowserSameSubjectAllowed(t *testing.T) {
 		Subject:      "kratos-user-1",
 	}, nil)
 
-	kratosPublic := newKratosWhoamiTestServer(t, "kratos-user-1")
-	t.Setenv("KRATOS_PUBLIC_URL", kratosPublic.URL)
+	t.Setenv("KRATOS_PUBLIC_URL", newKratosWhoamiTestServer(t, "kratos-user-1"))
 
 	mockKratos := new(MockKratosAdminService)
 	mockKratos.On("FindIdentityIDByIdentifier", mock.Anything, "user@example.com").Return("kratos-user-1", nil)
@@ -2237,8 +2188,7 @@ func TestPasswordLogin_SharedBrowserDifferentSubjectConflicts(t *testing.T) {
 		Subject:      "kratos-user-1",
 	}, nil)
 
-	kratosPublic := newKratosWhoamiTestServer(t, "kratos-other-user")
-	t.Setenv("KRATOS_PUBLIC_URL", kratosPublic.URL)
+	t.Setenv("KRATOS_PUBLIC_URL", newKratosWhoamiTestServer(t, "kratos-other-user"))
 
 	mockKratos := new(MockKratosAdminService)
 	mockKratos.On("FindIdentityIDByIdentifier", mock.Anything, "user@example.com").Return("kratos-user-1", nil)

backend/internal/handler/client_tenant_access.go

@@ -464,7 +464,7 @@ func normalizeScopesInConsentOrder(scopes []string) []string {
 
 	appendIfPresent := func(scope string) {
 		scope = strings.TrimSpace(scope)
-		if scope == "" {
+		if scope == "" || isLegacyRefreshTokenScopeAlias(scope) {
 			return
 		}
 		if _, ok := seen[scope]; ok {
@@ -485,7 +485,7 @@ func normalizeScopesInConsentOrder(scopes []string) []string {
 
 	for _, scope := range combined {
 		scope = strings.TrimSpace(scope)
-		if scope == "" {
+		if scope == "" || isLegacyRefreshTokenScopeAlias(scope) {
 			continue
 		}
 		if _, ok := seen[scope]; ok {

backend/internal/handler/client_tenant_access_test.go

@@ -8,6 +8,8 @@ import (
 	"io"
 	"net/http"
 	"net/http/httptest"
+	"net/url"
+	"strings"
 	"testing"
 
 	"github.com/gofiber/fiber/v2"
@@ -135,6 +137,43 @@ func TestMergeRequestedScopesWithClientRequirements_AddsTenantScope(t *testing.T
 	assert.Equal(t, []string{"openid", "tenant", "profile"}, merged)
 }
 
+func TestMergeRequestedScopesWithClientRequirements_StripsRefreshTokenScopeAliases(t *testing.T) {
+	client := domain.HydraClient{
+		Metadata: map[string]any{
+			"tenant_access_restricted": true,
+			"structured_scopes": []map[string]any{
+				{"name": "offline", "mandatory": true},
+				{"name": "offline_access", "locked": true},
+				{"name": "email", "mandatory": true},
+			},
+		},
+	}
+
+	merged := mergeRequestedScopesWithClientRequirements(
+		client,
+		[]string{"openid", "offline", "profile", "offline_access"},
+	)
+
+	assert.Equal(t, []string{"openid", "tenant", "profile", "offline_access", "email"}, merged)
+}
+
+func TestBuildHydraAuthorizationURL_StripsRefreshTokenScopeAliases(t *testing.T) {
+	urlString := buildHydraAuthorizationURL(
+		"client-refresh",
+		[]string{"offline", "profile", "offline_access", "email"},
+		[]string{"https://rp.example.com/callback"},
+	)
+
+	parsed, err := url.Parse(urlString)
+	assert.NoError(t, err)
+	scopes := parsed.Query().Get("scope")
+	scopeItems := strings.Fields(scopes)
+
+	assert.Equal(t, "openid profile offline_access email", scopes)
+	assert.NotContains(t, scopeItems, "offline")
+	assert.Contains(t, scopeItems, "offline_access")
+}
+
 func TestGetConsentRequest_DeniesTenantAccess(t *testing.T) {
 	transport := roundTripFunc(func(r *http.Request) (*http.Response, error) {
 		switch {

backend/internal/handler/dev_handler.go

@@ -15,6 +15,7 @@ import (
 	"io"
 	"log/slog"
 	"maps"
+	"math"
 	"net"
 	"net/http"
 	"net/url"
@@ -34,6 +35,7 @@ type DevHandler struct {
 	SecretRepo         domain.ClientSecretRepository
 	AuditRepo          domain.AuditRepository
 	KratosAdmin        service.KratosAdminService
+	IdentityWriter     service.IdentityWriteService
 	ConsentRepo        repository.ClientConsentRepository
 	Keto               service.KetoService
 	KetoOutbox         repository.KetoOutboxRepository
@@ -49,9 +51,10 @@ type DevHandler struct {
 
 type developerRequestService interface {
 	RequestAccess(ctx context.Context, req domain.DeveloperRequest) error
-	GetRequestStatus(ctx context.Context, userID, tenantID string) (*domain.DeveloperRequest, error)
+	GetRequestStatus(ctx context.Context, userID, tenantID string) (*domain.DeveloperAccessStatus, error)
 	GetRequestByID(ctx context.Context, id uint) (*domain.DeveloperRequest, error)
-	ListRequests(ctx context.Context, userID, status string) ([]domain.DeveloperRequest, error)
+	ListRequests(ctx context.Context, userID, status, tenantID string) ([]domain.DeveloperRequest, error)
+	CreateGrant(ctx context.Context, req domain.DeveloperRequest) error
 	ApproveRequest(ctx context.Context, id uint, adminNotes string) error
 	RejectRequest(ctx context.Context, id uint, adminNotes string) error
 	CancelApprovedRequest(ctx context.Context, id uint, adminNotes string) error
@@ -77,13 +80,18 @@ func NewDevHandler(
 		authProvider = auth[0]
 	}
 
+	kratosAdmin := service.NewKratosAdminService()
 	return &DevHandler{
 		Hydra:        service.NewHydraAdminService(),
 		Redis:        redis,
 		HeadlessJWKS: service.NewHeadlessJWKSCacheService(redis, nil),
 		SecretRepo:   secretRepo,
 		AuditRepo:    nil,
-		KratosAdmin:  service.NewKratosAdminService(),
+		KratosAdmin:  kratosAdmin,
+		IdentityWriter: service.NewIdentityWriteService(
+			kratosAdmin,
+			redis,
+		),
 		ConsentRepo:  consentRepo,
 		Keto:         keto,
 		KetoOutbox:   ketoOutbox,
@@ -232,6 +240,7 @@ type normalizedIDTokenClaim struct {
 	Key             string `json:"key"`
 	Value           string `json:"value"`
 	ValueType       string `json:"valueType"`
+	Nullable        bool   `json:"nullable"`
 	ReadPermission  string `json:"readPermission"`
 	WritePermission string `json:"writePermission"`
 }
@@ -274,6 +283,56 @@ func isDevConsoleViewerRole(role string) bool {
 	return r == domain.RoleSuperAdmin || r == domain.RoleUser
 }
 
+func normalizeDeveloperAccessPagesForHandler(pages []string) []string {
+	seen := make(map[string]struct{})
+	normalized := make([]string, 0, len(pages))
+	add := func(page string) {
+		page = strings.ToLower(strings.TrimSpace(page))
+		if page == "" {
+			return
+		}
+		if page == domain.DeveloperAccessPageAll {
+			normalized = []string{domain.DeveloperAccessPageAll}
+			seen = map[string]struct{}{domain.DeveloperAccessPageAll: {}}
+			return
+		}
+		for _, allowed := range domain.DeveloperAccessPageOrder {
+			if page == allowed {
+				if _, exists := seen[page]; exists {
+					return
+				}
+				seen[page] = struct{}{}
+				normalized = append(normalized, page)
+				return
+			}
+		}
+	}
+	for _, page := range pages {
+		add(page)
+		if len(normalized) == 1 && normalized[0] == domain.DeveloperAccessPageAll {
+			return normalized
+		}
+	}
+	if len(normalized) == 0 {
+		return []string{domain.DeveloperAccessPageAll}
+	}
+	return normalized
+}
+
+func developerAccessPagesEqual(left, right []string) bool {
+	leftNormalized := normalizeDeveloperAccessPagesForHandler(left)
+	rightNormalized := normalizeDeveloperAccessPagesForHandler(right)
+	if len(leftNormalized) != len(rightNormalized) {
+		return false
+	}
+	for i := range leftNormalized {
+		if leftNormalized[i] != rightNormalized[i] {
+			return false
+		}
+	}
+	return true
+}
+
 func setCurrentProfileContext(c *fiber.Ctx, profile *domain.UserProfileResponse) {
 	if profile == nil {
 		return
@@ -455,9 +514,7 @@ func (h *DevHandler) hasApprovedDeveloperRequest(c *fiber.Ctx, profile *domain.U
 	if err != nil || status == nil {
 		return false
 	}
-	return status.Status == domain.DeveloperRequestStatusApproved &&
-		strings.TrimSpace(status.UserID) == userID &&
-		strings.TrimSpace(status.TenantID) == tenantID
+	return status.Status == domain.DeveloperRequestStatusApproved
 }
 
 func (h *DevHandler) canOperateClientByPermit(c *fiber.Ctx, profile *domain.UserProfileResponse, summary clientSummary, relation string) bool {
@@ -517,6 +574,30 @@ func (h *DevHandler) canManageClientRelations(c *fiber.Ctx, profile *domain.User
 	return canAccessClientByLegacyScope(profile, summary)
 }
 
+func (h *DevHandler) canManageRPUserMetadata(c *fiber.Ctx, profile *domain.UserProfileResponse, summary clientSummary) bool {
+	if profile == nil {
+		return false
+	}
+	if normalizeUserRole(profile.Role) == domain.RoleSuperAdmin {
+		return true
+	}
+	return h.canOperateClientByPermit(c, profile, summary, "manage")
+}
+
+func (h *DevHandler) canSelfUpdateRPUserMetadata(c *fiber.Ctx, profile *domain.UserProfileResponse, summary clientSummary) bool {
+	if profile == nil {
+		return false
+	}
+	if normalizeUserRole(profile.Role) == domain.RoleSuperAdmin {
+		return true
+	}
+	if h.Keto == nil {
+		return true
+	}
+	allowed, err := h.checkProfileKetoPermission(c, profile, "RelyingParty", summary.ID, "access")
+	return err == nil && allowed
+}
+
 func (h *DevHandler) auditClientIDsByPermit(c *fiber.Ctx, profile *domain.UserProfileResponse, clientFilter string) map[string]struct{} {
 	ids := make(map[string]struct{})
 	if profile == nil || h.Hydra == nil {
@@ -1556,7 +1637,7 @@ func (h *DevHandler) UpsertRPUserMetadata(c *fiber.Ctx) error {
 	if err != nil {
 		return errorJSON(c, fiber.StatusNotFound, "client not found")
 	}
-	if !h.canManageClientRelations(c, profile, summary) {
+	if !h.canManageRPUserMetadata(c, profile, summary) {
 		return errorJSON(c, fiber.StatusForbidden, "forbidden: insufficient permission to update client metadata")
 	}
 
@@ -1589,6 +1670,73 @@ func (h *DevHandler) UpsertRPUserMetadata(c *fiber.Ctx) error {
 	return c.JSON(row)
 }
 
+func (h *DevHandler) SelfUpdateRPUserMetadata(c *fiber.Ctx) error {
+	clientID := strings.TrimSpace(c.Params("id"))
+	if clientID == "" {
+		return errorJSON(c, fiber.StatusBadRequest, "client id is required")
+	}
+	if h.RPUserMetadataRepo == nil {
+		return errorJSON(c, fiber.StatusServiceUnavailable, "rp user metadata repository unavailable")
+	}
+
+	profile := h.getCurrentProfile(c)
+	if profile == nil || strings.TrimSpace(profile.ID) == "" {
+		return errorJSON(c, fiber.StatusUnauthorized, "unauthorized: authentication required")
+	}
+
+	summary, err := h.loadClientSummary(c.Context(), clientID)
+	if err != nil {
+		return errorJSON(c, fiber.StatusNotFound, "client not found")
+	}
+	if !h.canSelfUpdateRPUserMetadata(c, profile, summary) {
+		return errorJSON(c, fiber.StatusForbidden, "forbidden: insufficient permission to update own client metadata")
+	}
+
+	var req struct {
+		Metadata map[string]any `json:"metadata"`
+	}
+	if err := c.BodyParser(&req); err != nil {
+		return errorJSON(c, fiber.StatusBadRequest, "invalid request body")
+	}
+	if req.Metadata == nil {
+		req.Metadata = map[string]any{}
+	}
+
+	filteredMetadata, err := filterSelfWritableRPUserMetadata(req.Metadata, summary.Metadata)
+	if err != nil {
+		return errorJSON(c, fiber.StatusForbidden, err.Error())
+	}
+	normalizedMetadata, err := normalizeRPUserMetadataForClient(filteredMetadata, summary.Metadata)
+	if err != nil {
+		return errorJSON(c, fiber.StatusBadRequest, err.Error())
+	}
+
+	userID := strings.TrimSpace(profile.ID)
+	mergedMetadata := domain.JSONMap{}
+	if existing, err := h.RPUserMetadataRepo.Get(c.Context(), clientID, userID); err == nil && existing != nil {
+		for key, value := range existing.Metadata {
+			mergedMetadata[key] = value
+		}
+	}
+	for key, value := range normalizedMetadata {
+		mergedMetadata[key] = value
+	}
+
+	row := &domain.RPUserMetadata{
+		ClientID: clientID,
+		UserID:   userID,
+		Metadata: mergedMetadata,
+	}
+	if err := h.RPUserMetadataRepo.Upsert(c.Context(), row); err != nil {
+		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
+	}
+	if err := h.syncRPUserMetadataToKratos(c.Context(), userID, clientID, mergedMetadata); err != nil {
+		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
+	}
+
+	return c.JSON(row)
+}
+
 func (h *DevHandler) syncRPUserMetadataToKratos(ctx context.Context, userID string, clientID string, metadata domain.JSONMap) error {
 	if h == nil || h.KratosAdmin == nil {
 		return nil
@@ -1610,7 +1758,17 @@ func (h *DevHandler) syncRPUserMetadataToKratos(ctx context.Context, userID stri
 	}
 	rawRPClaims[clientID] = metadata
 	traits["rp_custom_claims"] = rawRPClaims
-	_, err = h.KratosAdmin.UpdateIdentity(ctx, identity.ID, traits, identity.State)
+	identityWriter := h.IdentityWriter
+	if identityWriter == nil {
+		identityWriter = service.NewIdentityWriteService(h.KratosAdmin, h.Redis)
+	}
+	_, err = identityWriter.UpdateIdentity(ctx, service.IdentityUpdateRequest{
+		IdentityID: identity.ID,
+		Traits:     traits,
+		State:      identity.State,
+		Reason:     "rp_custom_claims_sync",
+		Source:     "dev_handler",
+	})
 	if err != nil {
 		return fmt.Errorf("failed to update kratos rp user metadata: %w", err)
 	}
@@ -1703,6 +1861,33 @@ func normalizeRPUserMetadataForClient(metadata map[string]any, clientMetadata ma
 	return normalized, nil
 }
 
+func filterSelfWritableRPUserMetadata(metadata map[string]any, clientMetadata map[string]any) (map[string]any, error) {
+	schemas, err := rpUserMetadataClaimSchemas(clientMetadata)
+	if err != nil {
+		return nil, err
+	}
+
+	filtered := map[string]any{}
+	for rawKey, rawValue := range metadata {
+		key := strings.TrimSpace(rawKey)
+		if key == "" || isEmptyRPUserMetadataValue(rawValue) {
+			continue
+		}
+		if strings.HasSuffix(key, "_permissions") {
+			return nil, fmt.Errorf("rp user metadata permission cannot be updated by user: %s", key)
+		}
+		schema, ok := schemas[key]
+		if !ok {
+			return nil, fmt.Errorf("rp user metadata claim is not configured: %s", key)
+		}
+		if normalizeCustomClaimPermission(schema.WritePermission) != "user_and_admin" {
+			return nil, fmt.Errorf("rp user metadata claim is admin only: %s", key)
+		}
+		filtered[key] = rawValue
+	}
+	return filtered, nil
+}
+
 func rpUserMetadataClaimSchemas(clientMetadata map[string]any) (map[string]rpUserMetadataClaimSchema, error) {
 	rawClaims, ok := clientMetadata[domain.MetadataIDTokenClaims]
 	if !ok || rawClaims == nil {
@@ -1915,7 +2100,7 @@ func (h *DevHandler) CreateClient(c *fiber.Ctx) error {
 		return errorJSON(c, fiber.StatusBadRequest, "redirectUris is required")
 	}
 
-	scopes := derefSlice(req.Scopes, defaultClientScopes())
+	scopes := normalizeClientScopes(derefSlice(req.Scopes, defaultClientScopes()))
 	grantTypes := derefSlice(req.GrantTypes, defaultGrantTypes())
 	responseTypes := derefSlice(req.ResponseTypes, defaultResponseTypes())
 
@@ -2002,7 +2187,7 @@ func (h *DevHandler) CreateClient(c *fiber.Ctx) error {
 		RedirectURIs:                     redirectURIs,
 		GrantTypes:                       grantTypes,
 		ResponseTypes:                    responseTypes,
-		Scope:                            strings.Join(scopes, " "),
+		Scope:                            buildScope(scopes),
 		TokenEndpointAuthMethod:          tokenAuthMethod,
 		SkipConsent:                      new(valueOrBool(req.SkipConsent, true)),
 		JWKSUri:                          jwksURI,
@@ -3404,14 +3589,17 @@ func normalizeIDTokenClaimsWithOptions(rawClaims any, allowTopLevel bool) ([]nor
 			valueType = "text"
 		}
 		switch valueType {
-		case "text", "number", "boolean", "array", "object", "date", "datetime":
+		case "text", "number", "float", "boolean", "array", "object", "date", "datetime":
 		default:
 			return nil, fmt.Errorf("metadata.id_token_claims valueType is invalid: %s", valueType)
 		}
 
-		value := strings.TrimSpace(readInterfaceString(record["value"], ""))
-		if _, err := parseConfiguredClaimValue(value, valueType); err != nil {
-			return nil, fmt.Errorf("metadata.id_token_claims %s.%s is invalid: %w", namespace, key, err)
+		value := strings.TrimSpace(readClaimValueString(record["value"], ""))
+		nullable, _ := record["nullable"].(bool)
+		if !(nullable && value == "") {
+			if _, err := parseConfiguredClaimValue(value, valueType); err != nil {
+				return nil, fmt.Errorf("metadata.id_token_claims %s.%s is invalid: %w", namespace, key, err)
+			}
 		}
 
 		signature := namespace + ":" + key
@@ -3425,6 +3613,7 @@ func normalizeIDTokenClaimsWithOptions(rawClaims any, allowTopLevel bool) ([]nor
 			Key:             key,
 			Value:           value,
 			ValueType:       valueType,
+			Nullable:        nullable,
 			ReadPermission:  normalizeCustomClaimPermission(record["readPermission"]),
 			WritePermission: normalizeCustomClaimPermission(record["writePermission"]),
 		})
@@ -3443,6 +3632,35 @@ func readInterfaceString(value any, fallback string) string {
 	return fallback
 }
 
+func readClaimValueString(value any, fallback string) string {
+	if value == nil {
+		return fallback
+	}
+	switch typed := value.(type) {
+	case string:
+		return typed
+	case float64:
+		if typed == math.Trunc(typed) {
+			return strconv.FormatInt(int64(typed), 10)
+		}
+		return strconv.FormatFloat(typed, 'f', -1, 64)
+	case float32:
+		floatValue := float64(typed)
+		if floatValue == math.Trunc(floatValue) {
+			return strconv.FormatInt(int64(floatValue), 10)
+		}
+		return strconv.FormatFloat(floatValue, 'f', -1, 64)
+	case int:
+		return strconv.Itoa(typed)
+	case int64:
+		return strconv.FormatInt(typed, 10)
+	case json.Number:
+		return typed.String()
+	default:
+		return fallback
+	}
+}
+
 func parseConfiguredClaimValue(rawValue string, valueType string) (any, error) {
 	trimmed := strings.TrimSpace(rawValue)
 
@@ -3453,9 +3671,24 @@ func parseConfiguredClaimValue(rawValue string, valueType string) (any, error) {
 		if trimmed == "" {
 			return nil, errors.New("number value is required")
 		}
+		if !isIntegerClaimLiteral(trimmed) {
+			return nil, errors.New("number value must be an integer")
+		}
 		parsed, err := strconv.ParseFloat(trimmed, 64)
 		if err != nil {
-			return nil, errors.New("number value must be a finite number")
+			return nil, errors.New("number value must be an integer")
+		}
+		return parsed, nil
+	case "float":
+		if trimmed == "" {
+			return nil, errors.New("float value is required")
+		}
+		if !isFloatClaimLiteral(trimmed) {
+			return nil, errors.New("float value must be a finite decimal number")
+		}
+		parsed, err := strconv.ParseFloat(trimmed, 64)
+		if err != nil {
+			return nil, errors.New("float value must be a finite decimal number")
 		}
 		return parsed, nil
 	case "boolean":
@@ -3500,26 +3733,89 @@ func parseConfiguredClaimValue(rawValue string, valueType string) (any, error) {
 		if trimmed == "" {
 			return nil, errors.New("date value is required")
 		}
-		if _, err := time.Parse("2006-01-02", trimmed); err != nil {
-			return nil, errors.New("date value must use YYYY-MM-DD")
+		if isIntegerClaimLiteral(trimmed) {
+			parsed, err := strconv.ParseInt(trimmed, 10, 64)
+			if err != nil {
+				return nil, errors.New("date value must use unix seconds or YYYY-MM-DD")
+			}
+			return parsed, nil
 		}
-		return trimmed, nil
+		parsed, err := time.Parse("2006-01-02", trimmed)
+		if err != nil {
+			return nil, errors.New("date value must use unix seconds or YYYY-MM-DD")
+		}
+		return parsed.Unix(), nil
 	case "datetime":
 		if trimmed == "" {
 			return nil, errors.New("datetime value is required")
 		}
-		if _, err := time.Parse(time.RFC3339, trimmed); err == nil {
-			return trimmed, nil
+		if isIntegerClaimLiteral(trimmed) {
+			parsed, err := strconv.ParseInt(trimmed, 10, 64)
+			if err != nil {
+				return nil, errors.New("datetime value must use unix seconds, RFC3339, or YYYY-MM-DDTHH:mm")
+			}
+			return parsed, nil
 		}
-		if _, err := time.Parse("2006-01-02T15:04", trimmed); err == nil {
-			return trimmed, nil
+		if parsed, err := time.Parse(time.RFC3339, trimmed); err == nil {
+			return parsed.Unix(), nil
 		}
-		return nil, errors.New("datetime value must use RFC3339 or YYYY-MM-DDTHH:mm")
+		if parsed, err := time.ParseInLocation("2006-01-02T15:04", trimmed, time.UTC); err == nil {
+			return parsed.Unix(), nil
+		}
+		return nil, errors.New("datetime value must use unix seconds, RFC3339, or YYYY-MM-DDTHH:mm")
 	default:
 		return nil, fmt.Errorf("unsupported claim value type: %s", valueType)
 	}
 }
 
+func isIntegerClaimLiteral(value string) bool {
+	if value == "" {
+		return false
+	}
+	start := 0
+	if value[0] == '-' {
+		if len(value) == 1 {
+			return false
+		}
+		start = 1
+	}
+	for _, char := range value[start:] {
+		if char < '0' || char > '9' {
+			return false
+		}
+	}
+	return true
+}
+
+func isFloatClaimLiteral(value string) bool {
+	if value == "" {
+		return false
+	}
+	start := 0
+	if value[0] == '-' {
+		if len(value) == 1 {
+			return false
+		}
+		start = 1
+	}
+	hasDigit := false
+	hasDot := false
+	for _, char := range value[start:] {
+		switch {
+		case char >= '0' && char <= '9':
+			hasDigit = true
+		case char == '.':
+			if hasDot {
+				return false
+			}
+			hasDot = true
+		default:
+			return false
+		}
+	}
+	return hasDigit
+}
+
 func requestIncludesInlineHeadlessJWKS(req clientUpsertRequest) bool {
 	if req.Jwks != nil {
 		return true
@@ -3544,7 +3840,33 @@ func defaultResponseTypes() []string {
 }
 
 func buildScope(scopes []string) string {
-	return strings.Join(scopes, " ")
+	return strings.Join(normalizeClientScopes(scopes), " ")
+}
+
+func normalizeClientScopes(scopes []string) []string {
+	normalized := make([]string, 0, len(scopes))
+	seen := make(map[string]struct{}, len(scopes))
+	for _, scope := range scopes {
+		scope = strings.TrimSpace(scope)
+		if scope == "" || isLegacyRefreshTokenScopeAlias(scope) {
+			continue
+		}
+		if _, ok := seen[scope]; ok {
+			continue
+		}
+		seen[scope] = struct{}{}
+		normalized = append(normalized, scope)
+	}
+	return normalized
+}
+
+func isLegacyRefreshTokenScopeAlias(scope string) bool {
+	switch strings.ToLower(strings.TrimSpace(scope)) {
+	case "offline":
+		return true
+	default:
+		return false
+	}
 }
 
 func valueOr(ptr *string, fallback string) string {
@@ -3805,6 +4127,85 @@ func (h *DevHandler) countScopedDashboardAuditMetrics(
 	return failureCount, int64(len(activeSessions)), nil
 }
 
+func appendDevTenantUnique(tenants []domain.Tenant, tenant domain.Tenant) []domain.Tenant {
+	tenantID := strings.TrimSpace(tenant.ID)
+	tenantSlug := strings.TrimSpace(tenant.Slug)
+	if tenantID == "" && tenantSlug == "" {
+		return tenants
+	}
+
+	for _, existing := range tenants {
+		if tenantID != "" && strings.EqualFold(existing.ID, tenantID) {
+			return tenants
+		}
+		if tenantSlug != "" && strings.EqualFold(existing.Slug, tenantSlug) {
+			return tenants
+		}
+	}
+
+	return append(tenants, tenant)
+}
+
+func shouldListDevManageableTenants(role string) bool {
+	switch strings.ToLower(strings.TrimSpace(role)) {
+	case "tenant_admin", "tenantadmin", "tenant-admin", "rp_admin", "admin":
+		return true
+	default:
+		return false
+	}
+}
+
+func resolveDevProfileAppointmentTenants(ctx context.Context, tenantSvc service.TenantService, metadata map[string]any) []domain.Tenant {
+	if tenantSvc == nil || metadata == nil {
+		return nil
+	}
+
+	appointments := userAppointmentSliceFromRaw(metadata["additionalAppointments"])
+	if len(appointments) == 0 {
+		return nil
+	}
+
+	tenants := make([]domain.Tenant, 0, len(appointments))
+	for _, raw := range appointments {
+		appointment, ok := raw.(map[string]any)
+		if !ok {
+			continue
+		}
+
+		if tenantID := normalizeMetadataString(appointment["tenantId"]); tenantID != "" {
+			if tenant, err := tenantSvc.GetTenant(ctx, tenantID); err == nil && tenant != nil {
+				tenants = appendDevTenantUnique(tenants, *tenant)
+				continue
+			}
+		}
+		if tenantID := normalizeMetadataString(appointment["tenant_id"]); tenantID != "" {
+			if tenant, err := tenantSvc.GetTenant(ctx, tenantID); err == nil && tenant != nil {
+				tenants = appendDevTenantUnique(tenants, *tenant)
+				continue
+			}
+		}
+		if tenantSlug := normalizeMetadataString(appointment["tenantSlug"]); tenantSlug != "" {
+			if tenant, err := tenantSvc.GetTenantBySlug(ctx, tenantSlug); err == nil && tenant != nil {
+				tenants = appendDevTenantUnique(tenants, *tenant)
+				continue
+			}
+		}
+		if tenantSlug := normalizeMetadataString(appointment["tenant_slug"]); tenantSlug != "" {
+			if tenant, err := tenantSvc.GetTenantBySlug(ctx, tenantSlug); err == nil && tenant != nil {
+				tenants = appendDevTenantUnique(tenants, *tenant)
+				continue
+			}
+		}
+		if tenantSlug := normalizeMetadataString(appointment["slug"]); tenantSlug != "" {
+			if tenant, err := tenantSvc.GetTenantBySlug(ctx, tenantSlug); err == nil && tenant != nil {
+				tenants = appendDevTenantUnique(tenants, *tenant)
+			}
+		}
+	}
+
+	return tenants
+}
+
 // ListMyTenants returns the list of tenants the current user manages or belongs to.
 func (h *DevHandler) ListMyTenants(c *fiber.Ctx) error {
 	profile, err := h.Auth.GetEnrichedProfile(c)
@@ -3813,20 +4214,6 @@ func (h *DevHandler) ListMyTenants(c *fiber.Ctx) error {
 	}
 
 	role := normalizeUserRole(profile.Role)
-	if role == domain.RoleUser {
-		if profile.TenantID == nil || strings.TrimSpace(*profile.TenantID) == "" {
-			return c.JSON([]domain.Tenant{})
-		}
-		tenant, err := h.TenantSvc.GetTenant(c.Context(), *profile.TenantID)
-		if err != nil {
-			return errorJSON(c, fiber.StatusInternalServerError, "failed to get tenant")
-		}
-		if tenant == nil {
-			return c.JSON([]domain.Tenant{})
-		}
-		return c.JSON([]domain.Tenant{*tenant})
-	}
-
 	if role == domain.RoleSuperAdmin {
 		tenants, _, err := h.TenantSvc.ListTenants(c.Context(), 100, 0, "", "")
 		if err != nil {
@@ -3835,26 +4222,32 @@ func (h *DevHandler) ListMyTenants(c *fiber.Ctx) error {
 		return c.JSON(tenants)
 	}
 
-	tenants, err := h.TenantSvc.ListManageableTenants(c.Context(), profile.ID)
-	if err != nil {
-		return errorJSON(c, fiber.StatusInternalServerError, "failed to list manageable tenants: "+err.Error())
+	tenants := make([]domain.Tenant, 0, 1+len(profile.JoinedTenants))
+	if shouldListDevManageableTenants(profile.Role) {
+		manageable, err := h.TenantSvc.ListManageableTenants(c.Context(), profile.ID)
+		if err != nil {
+			return errorJSON(c, fiber.StatusInternalServerError, "failed to list manageable tenants: "+err.Error())
+		}
+		for _, tenant := range manageable {
+			tenants = appendDevTenantUnique(tenants, tenant)
+		}
 	}
 
 	if profile.TenantID != nil && *profile.TenantID != "" {
-		found := false
-		for _, t := range tenants {
-			if t.ID == *profile.TenantID {
-				found = true
-				break
-			}
-		}
-		if !found {
-			if primary, err := h.TenantSvc.GetTenant(c.Context(), *profile.TenantID); err == nil && primary != nil {
-				tenants = append(tenants, *primary)
-			}
+		if primary, err := h.TenantSvc.GetTenant(c.Context(), *profile.TenantID); err != nil {
+			return errorJSON(c, fiber.StatusInternalServerError, "failed to get tenant")
+		} else if primary != nil {
+			tenants = appendDevTenantUnique(tenants, *primary)
 		}
 	}
 
+	for _, tenant := range profile.JoinedTenants {
+		tenants = appendDevTenantUnique(tenants, tenant)
+	}
+	for _, tenant := range resolveDevProfileAppointmentTenants(c.Context(), h.TenantSvc, profile.Metadata) {
+		tenants = appendDevTenantUnique(tenants, tenant)
+	}
+
 	return c.JSON(tenants)
 }
 
@@ -3871,10 +4264,11 @@ func (h *DevHandler) RequestDeveloperAccess(c *fiber.Ctx) error {
 	}
 
 	var req struct {
-		Name         string `json:"name"`
-		Organization string `json:"organization"`
-		Reason       string `json:"reason"`
-		TenantID     string `json:"tenantId"`
+		Name         string   `json:"name"`
+		Organization string   `json:"organization"`
+		Reason       string   `json:"reason"`
+		TenantID     string   `json:"tenantId"`
+		AccessPages  []string `json:"accessPages"`
 	}
 	if err := c.BodyParser(&req); err != nil {
 		return errorJSON(c, fiber.StatusBadRequest, "invalid request body")
@@ -3883,16 +4277,16 @@ func (h *DevHandler) RequestDeveloperAccess(c *fiber.Ctx) error {
 	if req.TenantID == "" && profile.TenantID != nil {
 		req.TenantID = *profile.TenantID
 	}
-	if req.TenantID == "" {
-		return errorJSON(c, fiber.StatusBadRequest, "tenantId is required")
-	}
 
 	name := strings.TrimSpace(profile.Name)
 	if name == "" {
 		name = strings.TrimSpace(req.Name)
 	}
 	organization := strings.TrimSpace(req.Organization)
-	if h.TenantSvc != nil {
+	if organization == "" {
+		organization = strings.TrimSpace(profile.CompanyCode)
+	}
+	if req.TenantID != "" && h.TenantSvc != nil {
 		if tenant, err := h.TenantSvc.GetTenant(c.Context(), req.TenantID); err == nil && tenant != nil && strings.TrimSpace(tenant.Name) != "" {
 			organization = strings.TrimSpace(tenant.Name)
 		}
@@ -3907,6 +4301,7 @@ func (h *DevHandler) RequestDeveloperAccess(c *fiber.Ctx) error {
 		Phone:        profile.Phone,
 		Role:         normalizeUserRole(profile.Role),
 		Reason:       req.Reason,
+		AccessPages:  req.AccessPages,
 		Status:       domain.DeveloperRequestStatusPending,
 	}
 
@@ -3927,9 +4322,6 @@ func (h *DevHandler) GetDeveloperRequestStatus(c *fiber.Ctx) error {
 	if tenantID == "" && profile.TenantID != nil {
 		tenantID = *profile.TenantID
 	}
-	if tenantID == "" {
-		return errorJSON(c, fiber.StatusBadRequest, "tenantId is required")
-	}
 
 	status, err := h.DeveloperSvc.GetRequestStatus(c.Context(), profile.ID, tenantID)
 	if err != nil {
@@ -3937,10 +4329,10 @@ func (h *DevHandler) GetDeveloperRequestStatus(c *fiber.Ctx) error {
 	}
 
 	if status == nil {
-		return c.JSON(fiber.Map{"status": "none"})
+		return c.JSON(domain.DeveloperAccessStatus{Status: "none"})
 	}
 	if status.Status == domain.DeveloperRequestStatusApproved {
-		h.ensureDeveloperGrantRelation(c, status.UserID, status.TenantID)
+		h.ensureDeveloperGrantRelation(c, profile.ID, tenantID)
 	}
 
 	return c.JSON(status)
@@ -4049,7 +4441,7 @@ func (h *DevHandler) ListDeveloperRequests(c *fiber.Ctx) error {
 		userID = ""
 	}
 
-	requests, err := h.DeveloperSvc.ListRequests(c.Context(), userID, status)
+	requests, err := h.DeveloperSvc.ListRequests(c.Context(), userID, status, "")
 	if err != nil {
 		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
 	}
@@ -4057,6 +4449,169 @@ func (h *DevHandler) ListDeveloperRequests(c *fiber.Ctx) error {
 	return c.JSON(requests)
 }
 
+func (h *DevHandler) ListDeveloperGrants(c *fiber.Ctx) error {
+	profile := h.getCurrentProfile(c)
+	if profile == nil {
+		return errorJSON(c, fiber.StatusUnauthorized, "unauthorized")
+	}
+	if normalizeUserRole(profile.Role) != domain.RoleSuperAdmin {
+		return errorJSON(c, fiber.StatusForbidden, "forbidden: super_admin only")
+	}
+
+	tenantID := strings.TrimSpace(c.Query("tenantId"))
+	grants, err := h.DeveloperSvc.ListRequests(c.Context(), "", domain.DeveloperRequestStatusApproved, tenantID)
+	if err != nil {
+		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
+	}
+
+	return c.JSON(grants)
+}
+
+func (h *DevHandler) CreateDeveloperGrant(c *fiber.Ctx) error {
+	profile := h.getCurrentProfile(c)
+	if profile == nil {
+		return errorJSON(c, fiber.StatusUnauthorized, "unauthorized")
+	}
+	if normalizeUserRole(profile.Role) != domain.RoleSuperAdmin {
+		return errorJSON(c, fiber.StatusForbidden, "forbidden: super_admin only")
+	}
+
+	var reqBody struct {
+		UserID      string   `json:"userId"`
+		TenantID    string   `json:"tenantId"`
+		Reason      string   `json:"reason"`
+		AdminNotes  string   `json:"adminNotes"`
+		AccessPages []string `json:"accessPages"`
+	}
+	if err := c.BodyParser(&reqBody); err != nil {
+		return errorJSON(c, fiber.StatusBadRequest, "invalid request body")
+	}
+
+	userID := strings.TrimSpace(reqBody.UserID)
+	tenantID := strings.TrimSpace(reqBody.TenantID)
+	if userID == "" {
+		return errorJSON(c, fiber.StatusBadRequest, "userId is required")
+	}
+	if h.KratosAdmin == nil {
+		return errorJSON(c, fiber.StatusServiceUnavailable, "required services are unavailable")
+	}
+
+	identity, err := h.KratosAdmin.GetIdentity(c.Context(), userID)
+	if err != nil || identity == nil {
+		return errorJSON(c, fiber.StatusNotFound, "user not found")
+	}
+
+	name := strings.TrimSpace(extractTraitString(identity.Traits, "name"))
+	if name == "" {
+		name = userID
+	}
+	organization := strings.TrimSpace(extractTraitString(identity.Traits, "companyCode"))
+	if tenantID != "" && h.TenantSvc != nil {
+		tenant, err := h.TenantSvc.GetTenant(c.Context(), tenantID)
+		if err != nil || tenant == nil {
+			return errorJSON(c, fiber.StatusNotFound, "tenant not found")
+		}
+		if strings.TrimSpace(tenant.Name) != "" {
+			organization = strings.TrimSpace(tenant.Name)
+		} else if organization == "" {
+			organization = tenantID
+		}
+	}
+	email := strings.TrimSpace(extractTraitString(identity.Traits, "email"))
+	phone := strings.TrimSpace(extractTraitString(identity.Traits, "phone"))
+	role := normalizeUserRole(extractTraitString(identity.Traits, "role"))
+	if role == "" {
+		role = domain.RoleUser
+	}
+	reason := strings.TrimSpace(reqBody.Reason)
+	if reason == "" {
+		reason = "직접 부여"
+	}
+
+	existingRequests, err := h.DeveloperSvc.ListRequests(c.Context(), userID, "", tenantID)
+	if err != nil {
+		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
+	}
+	for _, existing := range existingRequests {
+		if !developerAccessPagesEqual(existing.AccessPages, reqBody.AccessPages) {
+			continue
+		}
+
+		switch existing.Status {
+		case domain.DeveloperRequestStatusApproved:
+			h.ensureDeveloperGrantRelation(c, userID, tenantID)
+			return c.JSON(existing)
+		case domain.DeveloperRequestStatusPending:
+			if err := h.DeveloperSvc.ApproveRequest(c.Context(), existing.ID, reqBody.AdminNotes); err != nil {
+				return errorJSON(c, fiber.StatusInternalServerError, err.Error())
+			}
+			h.ensureDeveloperGrantRelation(c, userID, tenantID)
+			existing.Status = domain.DeveloperRequestStatusApproved
+			existing.AdminNotes = reqBody.AdminNotes
+			return c.JSON(existing)
+		}
+	}
+
+	grant := domain.DeveloperRequest{
+		UserID:       userID,
+		TenantID:     tenantID,
+		Name:         name,
+		Organization: organization,
+		Email:        email,
+		Phone:        phone,
+		Role:         role,
+		Reason:       reason,
+		AccessPages:  reqBody.AccessPages,
+		Status:       domain.DeveloperRequestStatusApproved,
+		AdminNotes:   strings.TrimSpace(reqBody.AdminNotes),
+	}
+	if err := h.DeveloperSvc.CreateGrant(c.Context(), grant); err != nil {
+		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
+	}
+	h.ensureDeveloperGrantRelation(c, userID, tenantID)
+
+	return c.Status(fiber.StatusCreated).JSON(grant)
+}
+
+func (h *DevHandler) RevokeDeveloperGrant(c *fiber.Ctx) error {
+	profile := h.getCurrentProfile(c)
+	if profile == nil {
+		return errorJSON(c, fiber.StatusUnauthorized, "unauthorized")
+	}
+	if normalizeUserRole(profile.Role) != domain.RoleSuperAdmin {
+		return errorJSON(c, fiber.StatusForbidden, "forbidden: super_admin only")
+	}
+
+	idStr := c.Params("id")
+	id, err := strconv.ParseUint(idStr, 10, 32)
+	if err != nil {
+		return errorJSON(c, fiber.StatusBadRequest, "invalid grant id")
+	}
+
+	var reqBody struct {
+		AdminNotes string `json:"adminNotes"`
+	}
+	if err := c.BodyParser(&reqBody); err != nil {
+		return errorJSON(c, fiber.StatusBadRequest, "invalid request body")
+	}
+
+	devReq, err := h.DeveloperSvc.GetRequestByID(c.Context(), uint(id))
+	if err != nil {
+		return errorJSON(c, fiber.StatusInternalServerError, "failed to fetch grant details")
+	}
+	if devReq.Status != domain.DeveloperRequestStatusApproved {
+		return errorJSON(c, fiber.StatusBadRequest, "only approved grants can be revoked")
+	}
+
+	if err := h.DeveloperSvc.CancelApprovedRequest(c.Context(), uint(id), reqBody.AdminNotes); err != nil {
+		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
+	}
+
+	h.revokeDeveloperGrantRelation(c, devReq.UserID, devReq.TenantID)
+
+	return c.JSON(fiber.Map{"status": "ok"})
+}
+
 func (h *DevHandler) ApproveDeveloperRequest(c *fiber.Ctx) error {
 	profile := h.getCurrentProfile(c)
 	if profile == nil {

backend/internal/handler/dev_handler_rp_metadata_test.go

@@ -48,6 +48,42 @@ func TestDevHandler_RPUserMetadataRoundTrip(t *testing.T) {
 							"valueType": "text",
 							"value":     "A",
 						},
+						{
+							"namespace": "rp_claims",
+							"key":       "activeMember",
+							"valueType": "boolean",
+							"value":     "true",
+						},
+						{
+							"namespace": "rp_claims",
+							"key":       "score",
+							"valueType": "number",
+							"value":     "1",
+						},
+						{
+							"namespace": "rp_claims",
+							"key":       "featureList",
+							"valueType": "array",
+							"value":     `["default"]`,
+						},
+						{
+							"namespace": "rp_claims",
+							"key":       "preferences",
+							"valueType": "object",
+							"value":     `{"theme":"light","density":"comfortable"}`,
+						},
+						{
+							"namespace": "rp_claims",
+							"key":       "contractDate",
+							"valueType": "date",
+							"value":     "2026-06-09",
+						},
+						{
+							"namespace": "rp_claims",
+							"key":       "approvedAt",
+							"valueType": "datetime",
+							"value":     "2026-06-09T09:30",
+						},
 					},
 				},
 			}), nil
@@ -60,8 +96,16 @@ func TestDevHandler_RPUserMetadataRoundTrip(t *testing.T) {
 		return row.ClientID == "client-1" &&
 			row.UserID == "user-1" &&
 			row.Metadata["approvalLevel"] == "A" &&
+			row.Metadata["activeMember"] == false &&
+			row.Metadata["score"] == float64(42) &&
+			assert.ObjectsAreEqual([]any{"sso", "claims"}, row.Metadata["featureList"]) &&
+			assert.ObjectsAreEqual(map[string]any{"theme": "dark", "density": "compact"}, row.Metadata["preferences"]) &&
+			rpMetadataNumberEquals(row.Metadata["contractDate"], 1781017200) &&
+			rpMetadataNumberEquals(row.Metadata["approvedAt"], 1780968600) &&
 			row.Metadata["approvalLevel_permissions"].(map[string]any)["readPermission"] == "admin_only" &&
-			row.Metadata["approvalLevel_permissions"].(map[string]any)["writePermission"] == "user_and_admin"
+			row.Metadata["approvalLevel_permissions"].(map[string]any)["writePermission"] == "user_and_admin" &&
+			row.Metadata["featureList_permissions"].(map[string]any)["readPermission"] == "admin_only" &&
+			row.Metadata["featureList_permissions"].(map[string]any)["writePermission"] == "admin_only"
 	})).Return(nil).Once()
 	repo.On("Get", mock.Anything, "client-1", "user-1").Return(&domain.RPUserMetadata{
 		ClientID: "client-1",
@@ -87,6 +131,15 @@ func TestDevHandler_RPUserMetadataRoundTrip(t *testing.T) {
 	body, _ := json.Marshal(map[string]any{
 		"metadata": map[string]any{
 			"approvalLevel": "A",
+			"activeMember":  false,
+			"score":         42,
+			"featureList":   []string{"sso", "claims"},
+			"preferences": map[string]any{
+				"theme":   "dark",
+				"density": "compact",
+			},
+			"contractDate": float64(1781017200),
+			"approvedAt":   float64(1780968600),
 			"approvalLevel_permissions": map[string]any{
 				"writePermission": "user_and_admin",
 			},
@@ -109,6 +162,100 @@ func TestDevHandler_RPUserMetadataRoundTrip(t *testing.T) {
 	repo.AssertExpectations(t)
 }
 
+func TestDevHandler_RPUserMetadataAdminUpsertRequiresRPManage(t *testing.T) {
+	transport := roundTripFunc(func(r *http.Request) (*http.Response, error) {
+		if r.URL.Path == "/clients/client-1" {
+			return httpJSONAny(r, http.StatusOK, map[string]any{
+				"client_id":   "client-1",
+				"client_name": "Client One",
+				"metadata": map[string]any{
+					"tenant_id": "tenant-1",
+					"id_token_claims": []map[string]any{
+						{
+							"namespace":       "rp_claims",
+							"key":             "approvalLevel",
+							"valueType":       "text",
+							"value":           "A",
+							"readPermission":  "user_and_admin",
+							"writePermission": "user_and_admin",
+						},
+					},
+				},
+			}), nil
+		}
+		return httpJSONAny(r, http.StatusNotFound, nil), nil
+	})
+
+	t.Run("tenant grant does not allow rp user metadata admin upsert", func(t *testing.T) {
+		repo := new(devMockRPUserMetadataRepo)
+		repo.On("Upsert", mock.Anything, mock.AnythingOfType("*domain.RPUserMetadata")).Return(nil).Maybe()
+		keto := new(devMockKetoService)
+		keto.On("CheckPermission", mock.Anything, "User:operator-1", "RelyingParty", "client-1", "manage").Return(false, nil)
+		keto.On("CheckPermission", mock.Anything, "User:operator-1", "Tenant", "tenant-1", "grant_dev_permissions").Return(true, nil).Maybe()
+		h := &DevHandler{
+			Hydra: &service.HydraAdminService{
+				AdminURL:   "http://hydra.test",
+				HTTPClient: &http.Client{Transport: transport},
+			},
+			Keto:               keto,
+			RPUserMetadataRepo: repo,
+		}
+		app := fiber.New()
+		app.Use(func(c *fiber.Ctx) error {
+			c.Locals("user_profile", &domain.UserProfileResponse{ID: "operator-1", Role: domain.RoleUser})
+			return c.Next()
+		})
+		app.Put("/api/v1/dev/clients/:id/users/:userId/metadata", h.UpsertRPUserMetadata)
+
+		body, _ := json.Marshal(map[string]any{
+			"metadata": map[string]any{"approvalLevel": "B"},
+		})
+		req := httptest.NewRequest(http.MethodPut, "/api/v1/dev/clients/client-1/users/user-1/metadata", bytes.NewReader(body))
+		req.Header.Set("Content-Type", "application/json")
+		resp, _ := app.Test(req, -1)
+
+		require.Equal(t, http.StatusForbidden, resp.StatusCode)
+		repo.AssertNotCalled(t, "Upsert", mock.Anything, mock.Anything)
+		keto.AssertExpectations(t)
+	})
+
+	t.Run("rp manage allows rp user metadata admin upsert", func(t *testing.T) {
+		repo := new(devMockRPUserMetadataRepo)
+		repo.On("Upsert", mock.Anything, mock.MatchedBy(func(row *domain.RPUserMetadata) bool {
+			return row.ClientID == "client-1" &&
+				row.UserID == "user-1" &&
+				row.Metadata["approvalLevel"] == "B"
+		})).Return(nil).Once()
+		keto := new(devMockKetoService)
+		keto.On("CheckPermission", mock.Anything, "User:operator-1", "RelyingParty", "client-1", "manage").Return(true, nil)
+		h := &DevHandler{
+			Hydra: &service.HydraAdminService{
+				AdminURL:   "http://hydra.test",
+				HTTPClient: &http.Client{Transport: transport},
+			},
+			Keto:               keto,
+			RPUserMetadataRepo: repo,
+		}
+		app := fiber.New()
+		app.Use(func(c *fiber.Ctx) error {
+			c.Locals("user_profile", &domain.UserProfileResponse{ID: "operator-1", Role: domain.RoleUser})
+			return c.Next()
+		})
+		app.Put("/api/v1/dev/clients/:id/users/:userId/metadata", h.UpsertRPUserMetadata)
+
+		body, _ := json.Marshal(map[string]any{
+			"metadata": map[string]any{"approvalLevel": "B"},
+		})
+		req := httptest.NewRequest(http.MethodPut, "/api/v1/dev/clients/client-1/users/user-1/metadata", bytes.NewReader(body))
+		req.Header.Set("Content-Type", "application/json")
+		resp, _ := app.Test(req, -1)
+
+		require.Equal(t, http.StatusOK, resp.StatusCode)
+		repo.AssertExpectations(t)
+		keto.AssertExpectations(t)
+	})
+}
+
 func TestDevHandler_RPUserMetadataMirrorsToKratosTraits(t *testing.T) {
 	transport := roundTripFunc(func(r *http.Request) (*http.Response, error) {
 		if r.URL.Path == "/clients/client-1" {
@@ -148,6 +295,7 @@ func TestDevHandler_RPUserMetadataMirrorsToKratosTraits(t *testing.T) {
 	kratos.On("UpdateIdentity", mock.Anything, "user-1", mock.Anything, "active").Run(func(args mock.Arguments) {
 		capturedTraits = args.Get(2).(map[string]any)
 	}).Return(&service.KratosIdentity{ID: "user-1", State: "active", Traits: map[string]any{}}, nil).Once()
+	identityWriter := service.NewIdentityWriteService(kratos, nil)
 
 	h := &DevHandler{
 		Hydra: &service.HydraAdminService{
@@ -155,6 +303,7 @@ func TestDevHandler_RPUserMetadataMirrorsToKratosTraits(t *testing.T) {
 			HTTPClient: &http.Client{Transport: transport},
 		},
 		KratosAdmin:        kratos,
+		IdentityWriter:     identityWriter,
 		RPUserMetadataRepo: repo,
 	}
 	app := fiber.New()
@@ -183,6 +332,145 @@ func TestDevHandler_RPUserMetadataMirrorsToKratosTraits(t *testing.T) {
 	kratos.AssertExpectations(t)
 }
 
+func rpMetadataNumberEquals(value any, want int64) bool {
+	switch typed := value.(type) {
+	case int64:
+		return typed == want
+	case int:
+		return int64(typed) == want
+	case float64:
+		return typed == float64(want)
+	case float32:
+		return float64(typed) == float64(want)
+	default:
+		return false
+	}
+}
+
+func TestDevHandler_SelfUpdateRPUserMetadataHonorsWritePermission(t *testing.T) {
+	transport := roundTripFunc(func(r *http.Request) (*http.Response, error) {
+		if r.URL.Path == "/clients/client-1" {
+			return httpJSONAny(r, http.StatusOK, map[string]any{
+				"client_id":   "client-1",
+				"client_name": "Client One",
+				"metadata": map[string]any{
+					"tenant_id": "tenant-1",
+					"id_token_claims": []map[string]any{
+						{
+							"namespace":       "rp_claims",
+							"key":             "approvalLevel",
+							"valueType":       "text",
+							"value":           "A",
+							"readPermission":  "user_and_admin",
+							"writePermission": "user_and_admin",
+						},
+						{
+							"namespace":       "rp_claims",
+							"key":             "internalRank",
+							"valueType":       "text",
+							"value":           "S",
+							"readPermission":  "admin_only",
+							"writePermission": "admin_only",
+						},
+					},
+				},
+			}), nil
+		}
+		return httpJSONAny(r, http.StatusNotFound, nil), nil
+	})
+
+	t.Run("rejects admin_only claim", func(t *testing.T) {
+		repo := new(devMockRPUserMetadataRepo)
+		repo.On("Upsert", mock.Anything, mock.AnythingOfType("*domain.RPUserMetadata")).Return(nil).Maybe()
+		h := &DevHandler{
+			Hydra: &service.HydraAdminService{
+				AdminURL:   "http://hydra.test",
+				HTTPClient: &http.Client{Transport: transport},
+			},
+			RPUserMetadataRepo: repo,
+		}
+		app := fiber.New()
+		app.Use(func(c *fiber.Ctx) error {
+			c.Locals("user_profile", &domain.UserProfileResponse{ID: "user-1", Role: domain.RoleUser})
+			return c.Next()
+		})
+		app.Put("/api/v1/dev/clients/:id/users/me/metadata", h.SelfUpdateRPUserMetadata)
+
+		body, _ := json.Marshal(map[string]any{
+			"metadata": map[string]any{"internalRank": "A"},
+		})
+		req := httptest.NewRequest(http.MethodPut, "/api/v1/dev/clients/client-1/users/me/metadata", bytes.NewReader(body))
+		req.Header.Set("Content-Type", "application/json")
+		resp, _ := app.Test(req, -1)
+
+		require.Equal(t, http.StatusForbidden, resp.StatusCode)
+		repo.AssertNotCalled(t, "Upsert", mock.Anything, mock.Anything)
+	})
+
+	t.Run("allows user_and_admin claim for self", func(t *testing.T) {
+		repo := new(devMockRPUserMetadataRepo)
+		repo.On("Get", mock.Anything, "client-1", "user-1").Return(&domain.RPUserMetadata{
+			ClientID: "client-1",
+			UserID:   "user-1",
+			Metadata: domain.JSONMap{
+				"internalRank": "S",
+				"internalRank_permissions": map[string]any{
+					"readPermission":  "admin_only",
+					"writePermission": "admin_only",
+				},
+			},
+		}, nil).Once()
+		repo.On("Upsert", mock.Anything, mock.MatchedBy(func(row *domain.RPUserMetadata) bool {
+			return row.ClientID == "client-1" &&
+				row.UserID == "user-1" &&
+				row.Metadata["approvalLevel"] == "B" &&
+				row.Metadata["internalRank"] == "S"
+		})).Return(nil).Once()
+		kratos := new(MockKratosAdmin)
+		kratos.On("GetIdentity", mock.Anything, "user-1").Return(&service.KratosIdentity{
+			ID:    "user-1",
+			State: "active",
+			Traits: map[string]any{
+				"email": "user@example.com",
+			},
+		}, nil).Once()
+		var capturedTraits map[string]any
+		kratos.On("UpdateIdentity", mock.Anything, "user-1", mock.Anything, "active").Run(func(args mock.Arguments) {
+			capturedTraits = args.Get(2).(map[string]any)
+		}).Return(&service.KratosIdentity{ID: "user-1", State: "active", Traits: map[string]any{}}, nil).Once()
+		h := &DevHandler{
+			Hydra: &service.HydraAdminService{
+				AdminURL:   "http://hydra.test",
+				HTTPClient: &http.Client{Transport: transport},
+			},
+			KratosAdmin:        kratos,
+			IdentityWriter:     service.NewIdentityWriteService(kratos, nil),
+			RPUserMetadataRepo: repo,
+		}
+		app := fiber.New()
+		app.Use(func(c *fiber.Ctx) error {
+			c.Locals("user_profile", &domain.UserProfileResponse{ID: "user-1", Role: domain.RoleUser})
+			return c.Next()
+		})
+		app.Put("/api/v1/dev/clients/:id/users/me/metadata", h.SelfUpdateRPUserMetadata)
+
+		body, _ := json.Marshal(map[string]any{
+			"metadata": map[string]any{"approvalLevel": "B"},
+		})
+		req := httptest.NewRequest(http.MethodPut, "/api/v1/dev/clients/client-1/users/me/metadata", bytes.NewReader(body))
+		req.Header.Set("Content-Type", "application/json")
+		resp, _ := app.Test(req, -1)
+
+		require.Equal(t, http.StatusOK, resp.StatusCode)
+		rpClaims := capturedTraits["rp_custom_claims"].(map[string]any)
+		clientClaims := rpClaims["client-1"].(domain.JSONMap)
+		require.Equal(t, "B", clientClaims["approvalLevel"])
+		require.Equal(t, "S", clientClaims["internalRank"])
+		repo.AssertExpectations(t)
+		kratos.AssertExpectations(t)
+	})
+}
+
 func TestDevHandler_RPUserMetadataRejectsUndefinedClaimKey(t *testing.T) {
 	transport := roundTripFunc(func(r *http.Request) (*http.Response, error) {
 		if r.URL.Path == "/clients/client-1" {
@@ -276,3 +564,21 @@ func TestDevHandler_RPUserMetadataRejectsInvalidTypedClaimValue(t *testing.T) {
 	assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
 	repo.AssertNotCalled(t, "Upsert", mock.Anything, mock.Anything)
 }
+
+func TestNormalizeIDTokenClaimsMetadataAcceptsUnixDateDefaults(t *testing.T) {
+	metadata, err := normalizeIDTokenClaimsMetadata(map[string]any{
+		"id_token_claims": []any{
+			map[string]any{
+				"namespace": "rp_claims",
+				"key":       "contract_date",
+				"valueType": "date",
+				"value":     float64(1781020800),
+			},
+		},
+	})
+
+	require.NoError(t, err)
+	claims := metadata["id_token_claims"].([]normalizedIDTokenClaim)
+	require.Len(t, claims, 1)
+	require.Equal(t, "1781020800", claims[0].Value)
+}

backend/internal/handler/dev_handler_test.go

@@ -11,6 +11,7 @@ import (
 	"io"
 	"net/http"
 	"net/http/httptest"
+	"strings"
 	"testing"
 	"time"
 
@@ -71,10 +72,10 @@ func (m *devMockDeveloperService) RequestAccess(ctx context.Context, req domain.
 	return args.Error(0)
 }
 
-func (m *devMockDeveloperService) GetRequestStatus(ctx context.Context, userID, tenantID string) (*domain.DeveloperRequest, error) {
+func (m *devMockDeveloperService) GetRequestStatus(ctx context.Context, userID, tenantID string) (*domain.DeveloperAccessStatus, error) {
 	args := m.Called(ctx, userID, tenantID)
-	if req, ok := args.Get(0).(*domain.DeveloperRequest); ok {
-		return req, args.Error(1)
+	if status, ok := args.Get(0).(*domain.DeveloperAccessStatus); ok {
+		return status, args.Error(1)
 	}
 	return nil, args.Error(1)
 }
@@ -87,14 +88,19 @@ func (m *devMockDeveloperService) GetRequestByID(ctx context.Context, id uint) (
 	return nil, args.Error(1)
 }
 
-func (m *devMockDeveloperService) ListRequests(ctx context.Context, userID, status string) ([]domain.DeveloperRequest, error) {
-	args := m.Called(ctx, userID, status)
+func (m *devMockDeveloperService) ListRequests(ctx context.Context, userID, status, tenantID string) ([]domain.DeveloperRequest, error) {
+	args := m.Called(ctx, userID, status, tenantID)
 	if requests, ok := args.Get(0).([]domain.DeveloperRequest); ok {
 		return requests, args.Error(1)
 	}
 	return nil, args.Error(1)
 }
 
+func (m *devMockDeveloperService) CreateGrant(ctx context.Context, req domain.DeveloperRequest) error {
+	args := m.Called(ctx, req)
+	return args.Error(0)
+}
+
 func (m *devMockDeveloperService) ApproveRequest(ctx context.Context, id uint, adminNotes string) error {
 	args := m.Called(ctx, id, adminNotes)
 	return args.Error(0)
@@ -337,6 +343,97 @@ func TestGetCurrentProfile_PreservesExistingAuditUserContext(t *testing.T) {
 	assert.Equal(t, "existing-user", body["user_id"])
 }
 
+func TestListMyTenants_UserIncludesPrimaryJoinedAndMetadataAppointments(t *testing.T) {
+	primaryTenantID := "tenant-primary"
+	mockAuth := new(devMockAuthProvider)
+	mockTenant := new(MockTenantService)
+	handler := &DevHandler{Auth: mockAuth, TenantSvc: mockTenant}
+	app := fiber.New()
+	app.Get("/api/v1/dev/my-tenants", handler.ListMyTenants)
+
+	profile := &domain.UserProfileResponse{
+		ID:       "user-1",
+		Role:     domain.RoleUser,
+		TenantID: &primaryTenantID,
+		JoinedTenants: []domain.Tenant{
+			{ID: "tenant-joined", Slug: "joined", Name: "Joined Tenant", Status: domain.TenantStatusActive},
+		},
+		Metadata: map[string]any{
+			"additionalAppointments": []any{
+				map[string]any{"tenantId": "tenant-extra"},
+				map[string]any{"tenantSlug": "slug-extra"},
+			},
+		},
+	}
+	mockAuth.On("GetEnrichedProfile", mock.Anything).Return(profile, nil).Once()
+	mockTenant.On("GetTenant", mock.Anything, primaryTenantID).Return(&domain.Tenant{
+		ID: primaryTenantID, Slug: "primary", Name: "Primary Tenant", Status: domain.TenantStatusActive,
+	}, nil).Once()
+	mockTenant.On("GetTenant", mock.Anything, "tenant-extra").Return(&domain.Tenant{
+		ID: "tenant-extra", Slug: "extra-id", Name: "Extra Tenant By ID", Status: domain.TenantStatusActive,
+	}, nil).Once()
+	mockTenant.On("GetTenantBySlug", mock.Anything, "slug-extra").Return(&domain.Tenant{
+		ID: "tenant-slug-extra", Slug: "slug-extra", Name: "Extra Tenant By Slug", Status: domain.TenantStatusActive,
+	}, nil).Once()
+
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/dev/my-tenants", nil)
+	resp, _ := app.Test(req, -1)
+
+	assert.Equal(t, http.StatusOK, resp.StatusCode)
+	var tenants []domain.Tenant
+	assert.NoError(t, json.NewDecoder(resp.Body).Decode(&tenants))
+	assert.NoError(t, resp.Body.Close())
+	assertTenantIDs(t, tenants, []string{"tenant-primary", "tenant-joined", "tenant-extra", "tenant-slug-extra"})
+	mockAuth.AssertExpectations(t)
+	mockTenant.AssertExpectations(t)
+}
+
+func TestListMyTenants_TenantAdminIncludesManageableJoinedAndPrimary(t *testing.T) {
+	primaryTenantID := "tenant-primary"
+	mockAuth := new(devMockAuthProvider)
+	mockTenant := new(MockTenantService)
+	handler := &DevHandler{Auth: mockAuth, TenantSvc: mockTenant}
+	app := fiber.New()
+	app.Get("/api/v1/dev/my-tenants", handler.ListMyTenants)
+
+	profile := &domain.UserProfileResponse{
+		ID:       "tenant-admin-1",
+		Role:     "tenant_admin",
+		TenantID: &primaryTenantID,
+		JoinedTenants: []domain.Tenant{
+			{ID: "tenant-joined", Slug: "joined", Name: "Joined Tenant", Status: domain.TenantStatusActive},
+		},
+	}
+	mockAuth.On("GetEnrichedProfile", mock.Anything).Return(profile, nil).Once()
+	mockTenant.On("ListManageableTenants", mock.Anything, "tenant-admin-1").Return([]domain.Tenant{
+		{ID: "tenant-managed", Slug: "managed", Name: "Managed Tenant", Status: domain.TenantStatusActive},
+	}, nil).Once()
+	mockTenant.On("GetTenant", mock.Anything, primaryTenantID).Return(&domain.Tenant{
+		ID: primaryTenantID, Slug: "primary", Name: "Primary Tenant", Status: domain.TenantStatusActive,
+	}, nil).Once()
+
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/dev/my-tenants", nil)
+	resp, _ := app.Test(req, -1)
+
+	assert.Equal(t, http.StatusOK, resp.StatusCode)
+	var tenants []domain.Tenant
+	assert.NoError(t, json.NewDecoder(resp.Body).Decode(&tenants))
+	assert.NoError(t, resp.Body.Close())
+	assertTenantIDs(t, tenants, []string{"tenant-managed", "tenant-joined", "tenant-primary"})
+	mockAuth.AssertExpectations(t)
+	mockTenant.AssertExpectations(t)
+}
+
+func assertTenantIDs(t *testing.T, tenants []domain.Tenant, expected []string) {
+	t.Helper()
+
+	actual := make([]string, 0, len(tenants))
+	for _, tenant := range tenants {
+		actual = append(actual, tenant.ID)
+	}
+	assert.ElementsMatch(t, expected, actual)
+}
+
 func TestListClients_Success(t *testing.T) {
 	transport := roundTripFunc(func(r *http.Request) (*http.Response, error) {
 		if r.URL.Path == "/clients" {
@@ -475,7 +572,7 @@ func TestUpdateClient_ReservedSystemNameForbidden(t *testing.T) {
 				},
 				"grant_types":                []string{"authorization_code", "refresh_token"},
 				"response_types":             []string{"code"},
-				"scope":                      "openid profile email offline_access",
+				"scope":                      "openid profile email",
 				"token_endpoint_auth_method": "none",
 				"metadata":                   map[string]any{"status": "active"},
 			}), nil
@@ -525,7 +622,7 @@ func TestUpdateClient_PrivateClientAllowedByEditConfigPermission(t *testing.T) {
 				},
 				"grant_types":                []string{"authorization_code", "refresh_token"},
 				"response_types":             []string{"code"},
-				"scope":                      "openid profile email offline_access",
+				"scope":                      "openid profile email",
 				"token_endpoint_auth_method": "client_secret_basic",
 				"metadata": map[string]any{
 					"status":    "active",
@@ -542,7 +639,7 @@ func TestUpdateClient_PrivateClientAllowedByEditConfigPermission(t *testing.T) {
 				},
 				"grant_types":                []string{"authorization_code", "refresh_token"},
 				"response_types":             []string{"code"},
-				"scope":                      "openid profile email offline_access",
+				"scope":                      "openid profile email",
 				"token_endpoint_auth_method": "client_secret_basic",
 				"metadata": map[string]any{
 					"status":    "active",
@@ -604,7 +701,7 @@ func TestUpdateClient_ManagedRPAdminRequiresEditConfigPermission(t *testing.T) {
 				},
 				"grant_types":                []string{"authorization_code", "refresh_token"},
 				"response_types":             []string{"code"},
-				"scope":                      "openid profile email offline_access",
+				"scope":                      "openid profile email",
 				"token_endpoint_auth_method": "none",
 				"metadata": map[string]any{
 					"status":    "active",
@@ -672,7 +769,7 @@ func TestUpdateClient_SuperAdminBypassesEditConfigPermission(t *testing.T) {
 				},
 				"grant_types":                []string{"authorization_code", "refresh_token"},
 				"response_types":             []string{"code"},
-				"scope":                      "openid profile email offline_access",
+				"scope":                      "openid profile email",
 				"token_endpoint_auth_method": "client_secret_basic",
 				"metadata": map[string]any{
 					"status":    "active",
@@ -689,7 +786,7 @@ func TestUpdateClient_SuperAdminBypassesEditConfigPermission(t *testing.T) {
 				},
 				"grant_types":                []string{"authorization_code", "refresh_token"},
 				"response_types":             []string{"code"},
-				"scope":                      "openid profile email offline_access",
+				"scope":                      "openid profile email",
 				"token_endpoint_auth_method": "client_secret_basic",
 				"metadata": map[string]any{
 					"status":    "active",
@@ -1585,10 +1682,8 @@ func TestCreateClient_ApprovedDeveloperRequestAllowsCreateWhenTenantGrantNotVisi
 	mockKeto.On("CheckPermission", mock.Anything, "User:user-1", "System", "global", "manage_all").Return(false, nil).Maybe()
 
 	developerSvc := new(devMockDeveloperService)
-	developerSvc.On("GetRequestStatus", mock.Anything, "user-1", "tenant-a").Return(&domain.DeveloperRequest{
-		UserID:   "user-1",
-		TenantID: "tenant-a",
-		Status:   domain.DeveloperRequestStatusApproved,
+	developerSvc.On("GetRequestStatus", mock.Anything, "user-1", "tenant-a").Return(&domain.DeveloperAccessStatus{
+		Status: domain.DeveloperRequestStatusApproved,
 	}, nil).Maybe()
 
 	h := &DevHandler{
@@ -2082,6 +2177,131 @@ func TestCreateClient_HeadlessLoginPayloadMapping(t *testing.T) {
 	assert.False(t, hasRequestObjectAlg)
 }
 
+func TestCreateClient_StripsOfflineScopesAndKeepsRefreshTokenGrant(t *testing.T) {
+	var captured domain.HydraClient
+
+	transport := roundTripFunc(func(r *http.Request) (*http.Response, error) {
+		if r.Method == http.MethodPost && r.URL.Path == "/clients" {
+			body, err := io.ReadAll(r.Body)
+			assert.NoError(t, err)
+			err = json.Unmarshal(body, &captured)
+			assert.NoError(t, err)
+
+			return httpJSONAny(r, http.StatusCreated, map[string]any{
+				"client_id":                  captured.ClientID,
+				"client_name":                captured.ClientName,
+				"redirect_uris":              captured.RedirectURIs,
+				"grant_types":                captured.GrantTypes,
+				"response_types":             captured.ResponseTypes,
+				"scope":                      captured.Scope,
+				"token_endpoint_auth_method": captured.TokenEndpointAuthMethod,
+				"skip_consent":               captured.SkipConsent,
+				"metadata":                   captured.Metadata,
+			}), nil
+		}
+		return httpJSONAny(r, http.StatusNotFound, nil), nil
+	})
+
+	h := &DevHandler{
+		Hydra: &service.HydraAdminService{
+			AdminURL:   "http://hydra.test",
+			PublicURL:  "http://hydra.public",
+			HTTPClient: &http.Client{Transport: transport},
+		},
+		Keto: new(devMockKetoService),
+	}
+
+	app := fiber.New()
+	app.Use(func(c *fiber.Ctx) error {
+		c.Locals("user_profile", &domain.UserProfileResponse{ID: "test-user", Role: domain.RoleSuperAdmin})
+		return c.Next()
+	})
+	app.Post("/api/v1/dev/clients", h.CreateClient)
+
+	body, _ := json.Marshal(map[string]any{
+		"name":         "Refresh Token App",
+		"type":         "pkce",
+		"redirectUris": []string{"https://rp.example.com/callback"},
+		"scopes":       []string{"openid", "offline", "profile", "offline_access", "email"},
+	})
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/dev/clients", bytes.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, _ := app.Test(req, -1)
+	assert.Equal(t, http.StatusCreated, resp.StatusCode)
+	assert.Equal(t, "openid profile offline_access email", captured.Scope)
+	assert.NotContains(t, strings.Fields(captured.Scope), "offline")
+	assert.Contains(t, strings.Fields(captured.Scope), "offline_access")
+	assert.Contains(t, captured.GrantTypes, "refresh_token")
+}
+
+func TestUpdateClient_StripsStoredOfflineScopesAndKeepsRefreshTokenGrant(t *testing.T) {
+	var captured domain.HydraClient
+
+	transport := roundTripFunc(func(r *http.Request) (*http.Response, error) {
+		if r.Method == http.MethodGet && r.URL.Path == "/clients/client-refresh" {
+			return httpJSONAny(r, http.StatusOK, map[string]any{
+				"client_id":                  "client-refresh",
+				"client_name":                "Refresh Token App",
+				"redirect_uris":              []string{"https://rp.example.com/callback"},
+				"grant_types":                []string{"authorization_code", "refresh_token"},
+				"response_types":             []string{"code"},
+				"scope":                      "openid offline profile offline_access email",
+				"token_endpoint_auth_method": "none",
+				"metadata":                   map[string]any{"status": "active"},
+			}), nil
+		}
+		if r.Method == http.MethodPut && r.URL.Path == "/clients/client-refresh" {
+			body, err := io.ReadAll(r.Body)
+			assert.NoError(t, err)
+			err = json.Unmarshal(body, &captured)
+			assert.NoError(t, err)
+
+			return httpJSONAny(r, http.StatusOK, map[string]any{
+				"client_id":                  captured.ClientID,
+				"client_name":                captured.ClientName,
+				"redirect_uris":              captured.RedirectURIs,
+				"grant_types":                captured.GrantTypes,
+				"response_types":             captured.ResponseTypes,
+				"scope":                      captured.Scope,
+				"token_endpoint_auth_method": captured.TokenEndpointAuthMethod,
+				"skip_consent":               captured.SkipConsent,
+				"metadata":                   captured.Metadata,
+			}), nil
+		}
+		return httpJSONAny(r, http.StatusNotFound, nil), nil
+	})
+
+	h := &DevHandler{
+		Hydra: &service.HydraAdminService{
+			AdminURL:   "http://hydra.test",
+			PublicURL:  "http://hydra.public",
+			HTTPClient: &http.Client{Transport: transport},
+		},
+		Keto: new(devMockKetoService),
+	}
+
+	app := fiber.New()
+	app.Use(func(c *fiber.Ctx) error {
+		c.Locals("user_profile", &domain.UserProfileResponse{ID: "test-user", Role: domain.RoleSuperAdmin})
+		return c.Next()
+	})
+	app.Put("/api/v1/dev/clients/:id", h.UpdateClient)
+
+	body, _ := json.Marshal(map[string]any{
+		"name": "Refresh Token App Updated",
+	})
+	req := httptest.NewRequest(http.MethodPut, "/api/v1/dev/clients/client-refresh", bytes.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, _ := app.Test(req, -1)
+	assert.Equal(t, http.StatusOK, resp.StatusCode)
+	assert.Equal(t, "openid profile offline_access email", captured.Scope)
+	assert.NotContains(t, strings.Fields(captured.Scope), "offline")
+	assert.Contains(t, strings.Fields(captured.Scope), "offline_access")
+	assert.Contains(t, captured.GrantTypes, "refresh_token")
+}
+
 func TestCreateClient_DefaultsSkipConsentToTrue(t *testing.T) {
 	var captured domain.HydraClient
 
@@ -2426,6 +2646,13 @@ func TestCreateClient_NormalizesIDTokenClaimsMetadata(t *testing.T) {
 					"value":     "2",
 					"valueType": "number",
 				},
+				{
+					"id":        "claim-3",
+					"namespace": "rp_claims",
+					"key":       "ratio",
+					"value":     "3.14",
+					"valueType": "float",
+				},
 			},
 		},
 	})
@@ -2436,7 +2663,7 @@ func TestCreateClient_NormalizesIDTokenClaimsMetadata(t *testing.T) {
 	assert.Equal(t, http.StatusCreated, resp.StatusCode)
 
 	claims, ok := captured.Metadata[domain.MetadataIDTokenClaims].([]any)
-	if assert.True(t, ok) && assert.Len(t, claims, 2) {
+	if assert.True(t, ok) && assert.Len(t, claims, 3) {
 		first, ok := claims[0].(map[string]any)
 		if assert.True(t, ok) {
 			assert.Equal(t, "rp_claims", first["namespace"])
@@ -2454,6 +2681,14 @@ func TestCreateClient_NormalizesIDTokenClaimsMetadata(t *testing.T) {
 			assert.Equal(t, "2", second["value"])
 			assert.Equal(t, "number", second["valueType"])
 		}
+
+		third, ok := claims[2].(map[string]any)
+		if assert.True(t, ok) {
+			assert.Equal(t, "rp_claims", third["namespace"])
+			assert.Equal(t, "ratio", third["key"])
+			assert.Equal(t, "3.14", third["value"])
+			assert.Equal(t, "float", third["valueType"])
+		}
 	}
 }
 
@@ -3331,6 +3566,32 @@ func TestNormalizeIDTokenClaimsMetadata_AllowsDateAndDatetime(t *testing.T) {
 	assert.Equal(t, "datetime", claims[1].ValueType)
 }
 
+func TestNormalizeIDTokenClaimsMetadata_PreservesNullableDefaultValue(t *testing.T) {
+	metadata, err := normalizeIDTokenClaimsMetadata(map[string]any{
+		domain.MetadataIDTokenClaims: []any{
+			map[string]any{
+				"namespace":       "rp_claims",
+				"key":             "contract_date",
+				"value":           "",
+				"valueType":       "date",
+				"nullable":        true,
+				"readPermission":  "user_and_admin",
+				"writePermission": "user_and_admin",
+			},
+		},
+	})
+
+	assert.NoError(t, err)
+	claims := metadata[domain.MetadataIDTokenClaims].([]normalizedIDTokenClaim)
+	if assert.Len(t, claims, 1) {
+		assert.Equal(t, "contract_date", claims[0].Key)
+		assert.Equal(t, "date", claims[0].ValueType)
+		assert.True(t, claims[0].Nullable)
+		assert.Equal(t, "user_and_admin", claims[0].ReadPermission)
+		assert.Equal(t, "user_and_admin", claims[0].WritePermission)
+	}
+}
+
 func TestUpdateClient_RejectsTopLevelIDTokenClaimsFromDevConsole(t *testing.T) {
 	transport := roundTripFunc(func(r *http.Request) (*http.Response, error) {
 		if r.Method == http.MethodGet && r.URL.Path == "/clients/client-1" {

backend/internal/handler/rp_claims_e2e_test.go

@@ -0,0 +1,347 @@
+package handler
+
+import (
+	"baron-sso-backend/internal/domain"
+	"baron-sso-backend/internal/service"
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"testing"
+
+	"github.com/gofiber/fiber/v2"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/require"
+)
+
+type rpClaimsE2ERepo struct {
+	mu      sync.Mutex
+	rows    map[string]*domain.RPUserMetadata
+	getKeys []string
+}
+
+func newRPClaimsE2ERepo() *rpClaimsE2ERepo {
+	return &rpClaimsE2ERepo{rows: map[string]*domain.RPUserMetadata{}}
+}
+
+func (r *rpClaimsE2ERepo) Get(ctx context.Context, clientID, userID string) (*domain.RPUserMetadata, error) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	key := rpClaimsE2ERepoKey(clientID, userID)
+	r.getKeys = append(r.getKeys, key)
+	row, ok := r.rows[key]
+	if !ok {
+		return nil, fmt.Errorf("rp user metadata not found")
+	}
+	return cloneRPUserMetadata(row), nil
+}
+
+func (r *rpClaimsE2ERepo) Upsert(ctx context.Context, metadata *domain.RPUserMetadata) error {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	r.rows[rpClaimsE2ERepoKey(metadata.ClientID, metadata.UserID)] = cloneRPUserMetadata(metadata)
+	return nil
+}
+
+func (r *rpClaimsE2ERepo) seenGet(clientID, userID string) bool {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	key := rpClaimsE2ERepoKey(clientID, userID)
+	for _, seen := range r.getKeys {
+		if seen == key {
+			return true
+		}
+	}
+	return false
+}
+
+func rpClaimsE2ERepoKey(clientID, userID string) string {
+	return strings.TrimSpace(clientID) + "\x00" + strings.TrimSpace(userID)
+}
+
+func cloneRPUserMetadata(row *domain.RPUserMetadata) *domain.RPUserMetadata {
+	if row == nil {
+		return nil
+	}
+	cloned := &domain.RPUserMetadata{
+		ClientID: row.ClientID,
+		UserID:   row.UserID,
+		Metadata: domain.JSONMap{},
+	}
+	for key, value := range row.Metadata {
+		cloned.Metadata[key] = value
+	}
+	return cloned
+}
+
+func TestRPClaimsE2E_UpdatedClaimsAreScopedToCurrentRP(t *testing.T) {
+	const userID = "user-rp-e2e"
+	const clientA = "client-rp-a"
+	const clientB = "client-rp-b"
+
+	clients := map[string]map[string]any{
+		clientA: rpClaimsE2EClient(clientA, []map[string]any{
+			rpClaimsE2EClaim("approvalLevel", "text", "A", "user_and_admin", "user_and_admin"),
+			rpClaimsE2EClaim("activeMember", "boolean", "true", "user_and_admin", "user_and_admin"),
+			rpClaimsE2EClaim("score", "number", "1", "user_and_admin", "user_and_admin"),
+			rpClaimsE2EClaim("featureList", "array", `["default"]`, "user_and_admin", "user_and_admin"),
+			rpClaimsE2EClaim("preferences", "object", `{"theme":"light","density":"comfortable"}`, "user_and_admin", "user_and_admin"),
+			rpClaimsE2EClaim("contractDate", "date", float64(1780930800), "user_and_admin", "user_and_admin"),
+			rpClaimsE2EClaim("approvedAt", "datetime", float64(1780965000), "user_and_admin", "user_and_admin"),
+			rpClaimsE2EClaim("adminManagedNote", "text", "admin-default", "user_and_admin", "admin_only"),
+		}),
+		clientB: rpClaimsE2EClient(clientB, []map[string]any{
+			rpClaimsE2EClaim("approvalLevel", "text", "B-default", "user_and_admin", "user_and_admin"),
+			rpClaimsE2EClaim("activeMember", "boolean", "false", "user_and_admin", "user_and_admin"),
+		}),
+	}
+	challenges := map[string]string{
+		"challenge-client-a-default":      clientA,
+		"challenge-client-a-admin-update": clientA,
+		"challenge-client-a-self-update":  clientA,
+		"challenge-client-b-default":      clientB,
+		"challenge-client-b-update":       clientB,
+	}
+	capturedClaims := map[string]map[string]any{}
+	hydraClient := &http.Client{Transport: roundTripFunc(func(r *http.Request) (*http.Response, error) {
+		if strings.HasPrefix(r.URL.Path, "/clients/") {
+			clientID := strings.TrimPrefix(r.URL.Path, "/clients/")
+			client, ok := clients[clientID]
+			if !ok {
+				return httpJSONAny(r, http.StatusNotFound, nil), nil
+			}
+			return httpJSONAny(r, http.StatusOK, client), nil
+		}
+		if r.URL.Path == "/oauth2/auth/requests/consent" {
+			challenge := r.URL.Query().Get("consent_challenge")
+			clientID, ok := challenges[challenge]
+			if !ok {
+				return httpResponse(r, http.StatusNotFound, "not found"), nil
+			}
+			return httpJSONAny(r, http.StatusOK, map[string]any{
+				"challenge":       challenge,
+				"requested_scope": []string{"openid", "profile"},
+				"subject":         userID,
+				"client":          clients[clientID],
+			}), nil
+		}
+		if r.URL.Path == "/oauth2/auth/requests/consent/accept" {
+			challenge := r.URL.Query().Get("consent_challenge")
+			body, _ := io.ReadAll(r.Body)
+			var acceptReq map[string]any
+			_ = json.Unmarshal(body, &acceptReq)
+			session, _ := acceptReq["session"].(map[string]any)
+			idToken, _ := session["id_token"].(map[string]any)
+			capturedClaims[challenge] = idToken
+			return httpJSONAny(r, http.StatusOK, map[string]any{
+				"redirect_to": "http://rp/cb",
+			}), nil
+		}
+		return httpResponse(r, http.StatusNotFound, "not found"), nil
+	})}
+
+	repo := newRPClaimsE2ERepo()
+	kratos := new(MockKratosAdminService)
+	kratos.On("GetIdentity", mock.Anything, userID).Return(&service.KratosIdentity{
+		ID:    userID,
+		State: "active",
+		Traits: map[string]any{
+			"email": "rp-e2e@example.com",
+			"name":  "RP E2E User",
+		},
+	}, nil)
+
+	authHandler := &AuthHandler{
+		Hydra: &service.HydraAdminService{
+			AdminURL:   "http://hydra.test",
+			HTTPClient: hydraClient,
+		},
+		KratosAdmin:        kratos,
+		RPUserMetadataRepo: repo,
+	}
+	devHandler := &DevHandler{
+		Hydra: &service.HydraAdminService{
+			AdminURL:   "http://hydra.test",
+			HTTPClient: hydraClient,
+		},
+		RPUserMetadataRepo: repo,
+	}
+
+	app := fiber.New()
+	app.Put("/api/v1/dev/clients/:id/users/me/metadata", func(c *fiber.Ctx) error {
+		c.Locals("user_profile", &domain.UserProfileResponse{ID: userID, Role: domain.RoleUser})
+		return devHandler.SelfUpdateRPUserMetadata(c)
+	})
+	app.Put("/api/v1/dev/clients/:id/users/:userId/metadata", func(c *fiber.Ctx) error {
+		c.Locals("user_profile", &domain.UserProfileResponse{ID: "admin", Role: domain.RoleSuperAdmin})
+		return devHandler.UpsertRPUserMetadata(c)
+	})
+	app.Post("/api/v1/auth/consent/accept", authHandler.AcceptConsentRequest)
+
+	initialA := acceptRPClaimsE2EConsent(t, app, capturedClaims, "challenge-client-a-default")
+	assert.Equal(t, "A", rpClaimValue(t, initialA, "approvalLevel"))
+	assert.Equal(t, "user_and_admin", rpClaimPermission(t, initialA, "approvalLevel", "readPermission"))
+	assert.Equal(t, true, rpClaimValue(t, initialA, "activeMember"))
+	assert.Equal(t, float64(1), rpClaimValue(t, initialA, "score"))
+	assert.Equal(t, []any{"default"}, rpClaimValue(t, initialA, "featureList"))
+	assert.Equal(t, map[string]any{"theme": "light", "density": "comfortable"}, rpClaimValue(t, initialA, "preferences"))
+	assert.Equal(t, float64(1780930800), rpClaimValue(t, initialA, "contractDate"))
+	assert.Equal(t, float64(1780965000), rpClaimValue(t, initialA, "approvedAt"))
+
+	upsertRPClaimsE2EMetadata(t, app, clientA, userID, map[string]any{
+		"approvalLevel":    "B",
+		"activeMember":     false,
+		"score":            42,
+		"featureList":      []string{"sso", "claims"},
+		"preferences":      map[string]any{"theme": "dark", "density": "compact"},
+		"contractDate":     float64(1781017200),
+		"approvedAt":       float64(1780968600),
+		"adminManagedNote": "admin-updated",
+		"approvalLevel_permissions": map[string]any{
+			"writePermission": "user_and_admin",
+		},
+	})
+
+	updatedA := acceptRPClaimsE2EConsent(t, app, capturedClaims, "challenge-client-a-admin-update")
+	assert.Equal(t, "B", rpClaimValue(t, updatedA, "approvalLevel"))
+	assert.Equal(t, false, rpClaimValue(t, updatedA, "activeMember"))
+	assert.Equal(t, float64(42), rpClaimValue(t, updatedA, "score"))
+	assert.Equal(t, []any{"sso", "claims"}, rpClaimValue(t, updatedA, "featureList"))
+	assert.Equal(t, map[string]any{"theme": "dark", "density": "compact"}, rpClaimValue(t, updatedA, "preferences"))
+	assert.Equal(t, float64(1781017200), rpClaimValue(t, updatedA, "contractDate"))
+	assert.Equal(t, float64(1780968600), rpClaimValue(t, updatedA, "approvedAt"))
+	assert.Equal(t, "admin-updated", rpClaimValue(t, updatedA, "adminManagedNote"))
+	assert.NotContains(t, updatedA, "approvalLevel_permissions")
+	assert.NotContains(t, updatedA, "adminManagedNote_permissions")
+
+	rejectedSelfUpdate := putRPClaimsE2EMetadata(t, app, http.MethodPut, "/api/v1/dev/clients/"+clientA+"/users/me/metadata", map[string]any{
+		"metadata": map[string]any{
+			"adminManagedNote": "user-should-not-overwrite",
+		},
+	})
+	assert.Equal(t, http.StatusForbidden, rejectedSelfUpdate.StatusCode)
+
+	allowedSelfUpdate := putRPClaimsE2EMetadata(t, app, http.MethodPut, "/api/v1/dev/clients/"+clientA+"/users/me/metadata", map[string]any{
+		"metadata": map[string]any{
+			"approvalLevel": "C",
+		},
+	})
+	assert.Equal(t, http.StatusOK, allowedSelfUpdate.StatusCode)
+
+	selfUpdatedA := acceptRPClaimsE2EConsent(t, app, capturedClaims, "challenge-client-a-self-update")
+	assert.Equal(t, "C", rpClaimValue(t, selfUpdatedA, "approvalLevel"))
+	assert.Equal(t, "admin-updated", rpClaimValue(t, selfUpdatedA, "adminManagedNote"))
+
+	defaultB := acceptRPClaimsE2EConsent(t, app, capturedClaims, "challenge-client-b-default")
+	assert.Equal(t, "B-default", rpClaimValue(t, defaultB, "approvalLevel"))
+	assert.Equal(t, false, rpClaimValue(t, defaultB, "activeMember"))
+	assert.NotContains(t, defaultB, "score")
+	assert.NotContains(t, defaultB, "featureList")
+	assert.NotContains(t, defaultB, "adminManagedNote")
+
+	upsertRPClaimsE2EMetadata(t, app, clientB, userID, map[string]any{
+		"approvalLevel": "B-rp-only",
+		"activeMember":  true,
+	})
+	updatedB := acceptRPClaimsE2EConsent(t, app, capturedClaims, "challenge-client-b-update")
+	assert.Equal(t, "B-rp-only", rpClaimValue(t, updatedB, "approvalLevel"))
+	assert.Equal(t, true, rpClaimValue(t, updatedB, "activeMember"))
+	assert.NotEqual(t, rpClaimValue(t, selfUpdatedA, "approvalLevel"), rpClaimValue(t, updatedB, "approvalLevel"))
+	assert.NotContains(t, updatedB, "score")
+	assert.NotContains(t, updatedB, "featureList")
+
+	require.True(t, repo.seenGet(clientA, userID))
+	require.True(t, repo.seenGet(clientB, userID))
+	require.Contains(t, capturedClaims, "challenge-client-a-admin-update")
+	require.Contains(t, capturedClaims, "challenge-client-b-update")
+	kratos.AssertExpectations(t)
+}
+
+func rpClaimsE2EClient(clientID string, claims []map[string]any) map[string]any {
+	return map[string]any{
+		"client_id":   clientID,
+		"client_name": clientID,
+		"metadata": map[string]any{
+			"tenant_id":       "tenant-rp-e2e",
+			"id_token_claims": claims,
+		},
+	}
+}
+
+func rpClaimsE2EClaim(key string, valueType string, value any, readPermission string, writePermission string) map[string]any {
+	return map[string]any{
+		"namespace":       "rp_claims",
+		"key":             key,
+		"valueType":       valueType,
+		"value":           value,
+		"readPermission":  readPermission,
+		"writePermission": writePermission,
+	}
+}
+
+func acceptRPClaimsE2EConsent(t *testing.T, app *fiber.App, capturedClaims map[string]map[string]any, challenge string) map[string]any {
+	t.Helper()
+
+	body, _ := json.Marshal(map[string]any{
+		"consent_challenge": challenge,
+		"grant_scope":       []string{"openid", "profile"},
+	})
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/auth/consent/accept", bytes.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	resp, err := app.Test(req, -1)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+
+	idToken, ok := capturedClaims[challenge]
+	require.True(t, ok)
+	rpClaims, ok := idToken["rp_claims"].(map[string]any)
+	require.True(t, ok)
+	return rpClaims
+}
+
+func rpClaimValue(t *testing.T, claims map[string]any, key string) any {
+	t.Helper()
+
+	payload, ok := claims[key].(map[string]any)
+	require.Truef(t, ok, "rp_claims.%s must be an object payload", key)
+	return payload["value"]
+}
+
+func rpClaimPermission(t *testing.T, claims map[string]any, key string, permissionKey string) string {
+	t.Helper()
+
+	payload, ok := claims[key].(map[string]any)
+	require.Truef(t, ok, "rp_claims.%s must be an object payload", key)
+	value, ok := payload[permissionKey].(string)
+	require.Truef(t, ok, "rp_claims.%s.%s must be a string", key, permissionKey)
+	return value
+}
+
+func upsertRPClaimsE2EMetadata(t *testing.T, app *fiber.App, clientID, userID string, metadata map[string]any) {
+	t.Helper()
+
+	resp := putRPClaimsE2EMetadata(t, app, http.MethodPut, "/api/v1/dev/clients/"+clientID+"/users/"+userID+"/metadata", map[string]any{
+		"metadata": metadata,
+	})
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+}
+
+func putRPClaimsE2EMetadata(t *testing.T, app *fiber.App, method, path string, body map[string]any) *http.Response {
+	t.Helper()
+
+	payload, _ := json.Marshal(body)
+	req := httptest.NewRequest(method, path, bytes.NewReader(payload))
+	req.Header.Set("Content-Type", "application/json")
+	resp, err := app.Test(req, -1)
+	require.NoError(t, err)
+	return resp
+}

backend/internal/handler/tenant_assignment_policy.go

@@ -115,7 +115,7 @@ func tenantNamespaceIDsFromTraits(traits map[string]any) []string {
 	}
 	ids := make([]string, 0)
 	for key, value := range traits {
-		if key == "" || key == "metadata" {
+		if key == "" || isReservedTenantTraitKey(key) {
 			continue
 		}
 		switch value.(type) {

backend/internal/handler/test_server_helper_test.go

@@ -0,0 +1,91 @@
+package handler
+
+import (
+	"encoding/json"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+)
+
+func newIPv4TestServer(t *testing.T, handler http.Handler) *httptest.Server {
+	t.Helper()
+
+	ln, err := net.Listen("tcp4", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("failed to bind test server listener: %v", err)
+	}
+
+	server := httptest.NewUnstartedServer(handler)
+	server.Listener = ln
+	server.Start()
+	t.Cleanup(server.Close)
+
+	return server
+}
+
+func newJWKSHTTPClient(t *testing.T, jwksBody []byte) *http.Client {
+	t.Helper()
+
+	return &http.Client{
+		Transport: roundTripFunc(func(r *http.Request) (*http.Response, error) {
+			if r.URL.Path == "/.well-known/jwks.json" {
+				return httpResponse(r, http.StatusOK, string(jwksBody)), nil
+			}
+			return httpResponse(r, http.StatusNotFound, "not found"), nil
+		}),
+	}
+}
+
+func installKratosWhoamiClient(t *testing.T, identityID string) string {
+	t.Helper()
+
+	origDefaultClient := http.DefaultClient
+	http.DefaultClient = &http.Client{
+		Transport: roundTripFunc(func(r *http.Request) (*http.Response, error) {
+			if r.URL.Path != "/sessions/whoami" {
+				return httpResponse(r, http.StatusNotFound, "not found"), nil
+			}
+			if r.Header.Get("Cookie") == "" && r.Header.Get("X-Session-Token") == "" {
+				return httpResponse(r, http.StatusUnauthorized, "missing session"), nil
+			}
+			body, err := json.Marshal(map[string]any{
+				"id":               "session-123",
+				"authenticated_at": "2026-05-21T00:00:00Z",
+				"identity": map[string]any{
+					"id": identityID,
+					"traits": map[string]any{
+						"email": "user@example.com",
+					},
+				},
+			})
+			if err != nil {
+				return nil, err
+			}
+			resp := httpResponse(r, http.StatusOK, string(body))
+			resp.Header.Set("Content-Type", "application/json")
+			return resp, nil
+		}),
+	}
+	t.Cleanup(func() {
+		http.DefaultClient = origDefaultClient
+	})
+
+	return "http://kratos.test"
+}
+
+func jwksURL() string {
+	u := &url.URL{Scheme: "http", Host: "jwks.test", Path: "/.well-known/jwks.json"}
+	return u.String()
+}
+
+func mustJSONBody(t *testing.T, value any) []byte {
+	t.Helper()
+
+	body, err := json.Marshal(value)
+	if err != nil {
+		t.Fatalf("failed to marshal test body: %v", err)
+	}
+	return body
+}

backend/internal/handler/user_handler.go

@@ -16,6 +16,7 @@ import (
 	"net/http"
 	"net/mail"
 	"os"
+	"reflect"
 	"regexp"
 	"sort"
 	"strconv"
@@ -170,6 +171,145 @@ func mergeUserAddTenantAppointment(traits map[string]any, metadata map[string]an
 	return metadata
 }
 
+func removeUserTenantAppointment(traits map[string]any, metadata map[string]any, tenant *domain.Tenant) map[string]any {
+	if tenant == nil {
+		return metadata
+	}
+	if metadata == nil {
+		metadata = map[string]any{}
+	}
+
+	targetID := strings.ToLower(strings.TrimSpace(tenant.ID))
+	targetSlug := strings.ToLower(strings.TrimSpace(tenant.Slug))
+	matchesTarget := func(raw any) bool {
+		appointment, ok := raw.(map[string]any)
+		if !ok {
+			return false
+		}
+		tenantID := strings.ToLower(normalizeMetadataString(appointment["tenantId"]))
+		tenantSlug := strings.ToLower(normalizeMetadataString(appointment["tenantSlug"]))
+		if tenantSlug == "" {
+			tenantSlug = strings.ToLower(normalizeMetadataString(appointment["slug"]))
+		}
+		return (targetID != "" && tenantID == targetID) ||
+			(targetSlug != "" && tenantSlug == targetSlug)
+	}
+
+	appointments := userAppointmentSliceFromRaw(traits["additionalAppointments"])
+	if len(appointments) == 0 {
+		if legacyMetadata, ok := traits["metadata"].(map[string]any); ok {
+			appointments = userAppointmentSliceFromRaw(legacyMetadata["additionalAppointments"])
+		}
+	}
+	if incoming := userAppointmentSliceFromRaw(metadata["additionalAppointments"]); len(incoming) > 0 {
+		appointments = incoming
+	}
+
+	filtered := make([]any, 0, len(appointments))
+	removedPrimary := false
+	for _, appointment := range appointments {
+		if matchesTarget(appointment) {
+			if value, ok := metadataBoolFromMap(appointment.(map[string]any), "isPrimary", "primary", "representative", "isRepresentative"); ok && value {
+				removedPrimary = true
+			}
+			continue
+		}
+		filtered = append(filtered, appointment)
+	}
+	if len(filtered) > 0 {
+		traits["additionalAppointments"] = filtered
+		metadata["additionalAppointments"] = filtered
+	} else {
+		delete(traits, "additionalAppointments")
+		delete(metadata, "additionalAppointments")
+	}
+
+	delete(traits, tenant.ID)
+	delete(metadata, tenant.ID)
+	if primaryTenantID := strings.ToLower(normalizeMetadataString(traits["primaryTenantId"])); primaryTenantID == targetID && targetID != "" {
+		removedPrimary = true
+	}
+	if primaryTenantSlug := strings.ToLower(normalizeMetadataString(traits["primaryTenantSlug"])); primaryTenantSlug == targetSlug && targetSlug != "" {
+		removedPrimary = true
+	}
+	if removedPrimary {
+		delete(traits, "primaryTenantId")
+		delete(traits, "primaryTenantSlug")
+		delete(traits, "primaryTenantName")
+		delete(traits, "primaryTenantIsOwner")
+		delete(metadata, "primaryTenantId")
+		delete(metadata, "primaryTenantSlug")
+		delete(metadata, "primaryTenantName")
+		delete(metadata, "primaryTenantIsOwner")
+	}
+
+	return metadata
+}
+
+func userMetadataRecordFromAny(value any) map[string]any {
+	switch typed := value.(type) {
+	case map[string]any:
+		return typed
+	case domain.JSONMap:
+		return map[string]any(typed)
+	default:
+		return nil
+	}
+}
+
+func enforceGlobalCustomClaimWritePermissions(traits map[string]any, metadata map[string]any, isAdmin bool) error {
+	if isAdmin || metadata == nil {
+		return nil
+	}
+
+	incomingClaims := userMetadataRecordFromAny(metadata["global_custom_claims"])
+	if incomingClaims == nil {
+		return nil
+	}
+
+	existingClaims := userMetadataRecordFromAny(traits["global_custom_claims"])
+	existingPermissions := userMetadataRecordFromAny(traits["global_custom_claim_permissions"])
+	existingTypes := userMetadataRecordFromAny(traits["global_custom_claim_types"])
+
+	claimKeys := map[string]bool{}
+	for key := range incomingClaims {
+		claimKeys[strings.TrimSpace(key)] = true
+	}
+	for key := range existingClaims {
+		claimKeys[strings.TrimSpace(key)] = true
+	}
+
+	for key := range claimKeys {
+		if key == "" {
+			continue
+		}
+		incomingValue, incomingExists := incomingClaims[key]
+		existingValue, existingExists := existingClaims[key]
+		if incomingExists && existingExists && reflect.DeepEqual(incomingValue, existingValue) {
+			continue
+		}
+		if !incomingExists && !existingExists {
+			continue
+		}
+
+		permission := "admin_only"
+		if rawPermission := userMetadataRecordFromAny(existingPermissions[key]); rawPermission != nil {
+			permission = normalizeCustomClaimPermission(rawPermission["writePermission"])
+		}
+		if permission != "user_and_admin" {
+			return fmt.Errorf("global custom claim %s is admin only", key)
+		}
+	}
+
+	if len(existingPermissions) > 0 {
+		metadata["global_custom_claim_permissions"] = existingPermissions
+	}
+	if len(existingTypes) > 0 {
+		metadata["global_custom_claim_types"] = existingTypes
+	}
+	return nil
+}
+
 func sanitizeUserRepresentativeTenants(ctx context.Context, tenantService service.TenantService, metadata map[string]any, appointments []map[string]any) (bool, error) {
 	if tenantService == nil || metadata == nil {
 		return false, nil
@@ -1864,6 +2004,7 @@ func (h *UserHandler) BulkUpdateUsers(c *fiber.Ctx) error {
 		Role        *string  `json:"role"`
 		TenantSlug  *string  `json:"tenantSlug"`
 		CompanyCode *string  `json:"companyCode"`
+		IsAddTenant bool     `json:"isAddTenant"`
 		Department  *string  `json:"department"`
 		Grade       *string  `json:"grade"`
 		Position    *string  `json:"position"`
@@ -1950,6 +2091,8 @@ func (h *UserHandler) BulkUpdateUsers(c *fiber.Ctx) error {
 
 		// Prepare updates
 		traits := identity.Traits
+		oldRoleForSync := roleFromTraits(traits)
+		oldTenantIDForSync := extractTraitString(traits, "tenant_id")
 		if req.Role != nil {
 			traits["role"] = *req.Role
 		}
@@ -1957,8 +2100,30 @@ func (h *UserHandler) BulkUpdateUsers(c *fiber.Ctx) error {
 			delete(traits, "companyCode")
 			delete(traits, "companyCodes")
 
-			// Resolve and update tenant_id in traits if changed
-			if tItem, exists := tenantCache[*req.CompanyCode]; exists {
+			if req.IsAddTenant {
+				if h.TenantService == nil {
+					results = append(results, map[string]any{"id": id, "success": false, "message": "tenant service not available"})
+					continue
+				}
+				tenant, err := h.TenantService.GetTenantBySlug(c.Context(), *req.CompanyCode)
+				if err != nil || tenant == nil {
+					results = append(results, map[string]any{"id": id, "success": false, "message": "invalid tenant assignment"})
+					continue
+				}
+				metadata := mergeUserAddTenantAppointment(traits, nil, tenant)
+				if appointments, ok := metadata["additionalAppointments"]; ok {
+					traits["additionalAppointments"] = appointments
+				}
+				if h.KetoOutboxRepo != nil {
+					_ = h.KetoOutboxRepo.Create(c.Context(), &domain.KetoOutbox{
+						Namespace: "Tenant",
+						Object:    tenant.ID,
+						Relation:  "members",
+						Subject:   "User:" + id,
+						Action:    domain.KetoOutboxActionCreate,
+					})
+				}
+			} else if tItem, exists := tenantCache[*req.CompanyCode]; exists {
 				traits["tenant_id"] = tItem.ID
 			} else if h.TenantService != nil {
 				tenant, err := h.TenantService.GetTenantBySlug(c.Context(), *req.CompanyCode)
@@ -1990,7 +2155,7 @@ func (h *UserHandler) BulkUpdateUsers(c *fiber.Ctx) error {
 			}
 		}
 
-		_, err = h.KratosAdmin.UpdateIdentity(c.Context(), id, traits, state)
+		updated, err := h.KratosAdmin.UpdateIdentity(c.Context(), id, traits, state)
 		if err != nil {
 			results = append(results, map[string]any{"id": id, "success": false, "message": err.Error()})
 			continue
@@ -1998,9 +2163,7 @@ func (h *UserHandler) BulkUpdateUsers(c *fiber.Ctx) error {
 
 		// Sync to local DB
 		if h.UserRepo != nil {
-			localUser := h.mapToLocalUser(*identity)
-			oldRole := roleFromTraits(identity.Traits)
-			oldTenantID := extractTraitString(identity.Traits, "tenant_id")
+			localUser := h.mapToLocalUser(*updated)
 
 			if req.Role != nil {
 				localUser.Role = *req.Role
@@ -2035,7 +2198,7 @@ func (h *UserHandler) BulkUpdateUsers(c *fiber.Ctx) error {
 			// [Keto Sync]
 			if h.KetoOutboxRepo != nil {
 				h.syncKetoRole(c.Context(), localUser.ID,
-					localUser.Role, oldRole, oldTenantID, localUser.TenantID)
+					localUser.Role, oldRoleForSync, oldTenantIDForSync, localUser.TenantID)
 			}
 		}
 
@@ -2241,6 +2404,9 @@ func (h *UserHandler) UpdateUser(c *fiber.Ctx) error {
 
 	// [Validation] Based on Tenant Schema (Multi-tenant aware)
 	isAdmin := requester != nil && requester.Role == domain.RoleSuperAdmin
+	if err := enforceGlobalCustomClaimWritePermissions(identity.Traits, req.Metadata, isAdmin); err != nil {
+		return errorJSON(c, fiber.StatusForbidden, "forbidden: "+err.Error())
+	}
 
 	// If metadata is namespaced (key is tenant ID), validate each namespace
 	// If it's flat, validate using schemaCompCode
@@ -2329,26 +2495,22 @@ func (h *UserHandler) UpdateUser(c *fiber.Ctx) error {
 		code := strings.TrimSpace(*req.CompanyCode)
 
 		if req.IsRemoveTenant {
-			if h.TenantService != nil && h.KetoOutboxRepo != nil && code != "" {
-				go func(removedSlug string) {
-					bgCtx := context.Background()
-					if t, err := h.TenantService.GetTenantBySlug(bgCtx, removedSlug); err == nil && t != nil {
-						_ = h.KetoOutboxRepo.Create(bgCtx, &domain.KetoOutbox{
-							Namespace: "Tenant",
-							Object:    t.ID,
-							Relation:  "members",
-							Subject:   "User:" + userID,
-							Action:    domain.KetoOutboxActionDelete,
-						})
-					}
-				}(code)
-			}
 			if h.TenantService != nil && code != "" {
 				if tenant, err := h.TenantService.GetTenantBySlug(c.Context(), code); err == nil && tenant != nil {
 					currentTenantID := extractTraitString(traits, "tenant_id")
 					if currentTenantID == tenant.ID {
 						traits["tenant_id"] = ""
 					}
+					req.Metadata = removeUserTenantAppointment(traits, req.Metadata, tenant)
+					if h.KetoOutboxRepo != nil {
+						_ = h.KetoOutboxRepo.Create(c.Context(), &domain.KetoOutbox{
+							Namespace: "Tenant",
+							Object:    tenant.ID,
+							Relation:  "members",
+							Subject:   "User:" + userID,
+							Action:    domain.KetoOutboxActionDelete,
+						})
+					}
 				}
 			}
 		} else if !req.IsAddTenant {

backend/internal/handler/user_handler_test.go

@@ -1400,6 +1400,84 @@ func TestUserHandler_BulkUpdateUsers(t *testing.T) {
 	})
 }
 
+func TestUserHandler_BulkUpdateUsersAddTenantMembership(t *testing.T) {
+	app := fiber.New()
+	mockKratos := new(MockKratosAdmin)
+	mockTenant := new(MockTenantServiceForUser)
+	mockOutbox := new(userHandlerMockKetoOutboxRepository)
+	h := &UserHandler{
+		KratosAdmin:    mockKratos,
+		TenantService:  mockTenant,
+		KetoOutboxRepo: mockOutbox,
+	}
+	app.Put("/users/bulk", func(c *fiber.Ctx) error {
+		c.Locals("user_profile", &domain.UserProfileResponse{Role: domain.RoleSuperAdmin})
+		return h.BulkUpdateUsers(c)
+	})
+
+	mockKratos.On("GetIdentity", mock.Anything, "u-1").Return(&service.KratosIdentity{
+		ID:    "u-1",
+		State: "active",
+		Traits: map[string]any{
+			"email":     "u1@test.com",
+			"name":      "Bulk User",
+			"tenant_id": "primary-tenant-id",
+		},
+	}, nil).Once()
+	mockTenant.On("GetTenantBySlug", mock.Anything, "team-a").Return(&domain.Tenant{
+		ID:   "team-a-id",
+		Name: "Team A",
+		Slug: "team-a",
+	}, nil).Once()
+	mockKratos.On(
+		"UpdateIdentity",
+		mock.Anything,
+		"u-1",
+		mock.MatchedBy(func(traits map[string]any) bool {
+			if extractTraitString(traits, "tenant_id") != "primary-tenant-id" {
+				return false
+			}
+			appointments, ok := traits["additionalAppointments"].([]any)
+			if !ok || len(appointments) != 1 {
+				return false
+			}
+			appointment, ok := appointments[0].(map[string]any)
+			return ok &&
+				appointment["tenantId"] == "team-a-id" &&
+				appointment["tenantSlug"] == "team-a" &&
+				appointment["tenantName"] == "Team A"
+		}),
+		mock.Anything,
+	).Return(&service.KratosIdentity{
+		ID:    "u-1",
+		State: "active",
+		Traits: map[string]any{
+			"email":                  "u1@test.com",
+			"name":                   "Bulk User",
+			"tenant_id":              "primary-tenant-id",
+			"additionalAppointments": []any{map[string]any{"tenantId": "team-a-id", "tenantSlug": "team-a", "tenantName": "Team A"}},
+		},
+	}, nil).Once()
+	mockOutbox.On("Create", mock.Anything, mock.MatchedBy(func(entry *domain.KetoOutbox) bool {
+		return entry.Namespace == "Tenant" &&
+			entry.Object == "team-a-id" &&
+			entry.Relation == "members" &&
+			entry.Subject == "User:u-1" &&
+			entry.Action == domain.KetoOutboxActionCreate
+	})).Return(nil).Once()
+
+	body := `{"userIds":["u-1"],"tenantSlug":"team-a","isAddTenant":true}`
+	req := httptest.NewRequest(http.MethodPut, "/users/bulk", strings.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	resp, err := app.Test(req)
+
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+	mockKratos.AssertExpectations(t)
+	mockTenant.AssertExpectations(t)
+	mockOutbox.AssertExpectations(t)
+}
+
 func TestUserHandler_BulkDeleteUsers(t *testing.T) {
 	app := fiber.New()
 	mockKratos := new(MockKratosAdmin)
@@ -1702,6 +1780,137 @@ func TestUserHandler_UpdateUser_AdminOnlyField(t *testing.T) {
 	})
 }
 
+func TestUserHandler_UpdateUser_GlobalCustomClaimWritePermission(t *testing.T) {
+	newApp := func(t *testing.T, existingPermission string, updateIdentity bool) (*fiber.App, *MockKratosAdmin, *MockTenantServiceForUser, *map[string]any) {
+		t.Helper()
+		app := fiber.New()
+		mockKratos := new(MockKratosAdmin)
+		mockTenant := new(MockTenantServiceForUser)
+		capturedTraits := map[string]any(nil)
+		h := &UserHandler{
+			KratosAdmin:   mockKratos,
+			TenantService: mockTenant,
+		}
+
+		tenantID := "t-123"
+		app.Put("/users/:id", func(c *fiber.Ctx) error {
+			c.Locals("user_profile", &domain.UserProfileResponse{
+				ID:       "requester-1",
+				Role:     domain.RoleUser,
+				TenantID: &tenantID,
+				ManageableTenants: []domain.Tenant{
+					{ID: tenantID, Slug: "test-tenant"},
+				},
+			})
+			return h.UpdateUser(c)
+		})
+
+		mockKratos.On("GetIdentity", mock.Anything, "u-1").Return(&service.KratosIdentity{
+			ID:    "u-1",
+			State: "active",
+			Traits: map[string]any{
+				"email":     "user@test.com",
+				"name":      "Custom Claim User",
+				"tenant_id": tenantID,
+				"global_custom_claims": map[string]any{
+					"contract_date": "2026-06-09",
+				},
+				"global_custom_claim_types": map[string]any{
+					"contract_date": "date",
+				},
+				"global_custom_claim_permissions": map[string]any{
+					"contract_date": map[string]any{
+						"readPermission":  "user_and_admin",
+						"writePermission": existingPermission,
+					},
+				},
+			},
+		}, nil).Once()
+		mockTenant.On("GetTenant", mock.Anything, tenantID).Return(&domain.Tenant{
+			ID:   tenantID,
+			Slug: "test-tenant",
+			Config: domain.JSONMap{
+				"userSchema": []any{},
+			},
+		}, nil).Maybe()
+		if updateIdentity {
+			mockKratos.On("UpdateIdentity", mock.Anything, "u-1", mock.Anything, mock.Anything).Run(func(args mock.Arguments) {
+				capturedTraits = args.Get(2).(map[string]any)
+			}).Return(&service.KratosIdentity{
+				ID:    "u-1",
+				State: "active",
+				Traits: map[string]any{
+					"email": "user@test.com",
+					"name":  "Custom Claim User",
+				},
+			}, nil).Once()
+		} else {
+			mockKratos.On("UpdateIdentity", mock.Anything, "u-1", mock.Anything, mock.Anything).Return(&service.KratosIdentity{
+				ID:     "u-1",
+				State:  "active",
+				Traits: map[string]any{},
+			}, nil).Maybe()
+		}
+
+		return app, mockKratos, mockTenant, &capturedTraits
+	}
+
+	requestBody := func(nextValue string) *bytes.Reader {
+		body, _ := json.Marshal(map[string]any{
+			"metadata": map[string]any{
+				"global_custom_claims": map[string]any{
+					"contract_date": nextValue,
+				},
+				"global_custom_claim_types": map[string]any{
+					"contract_date": "date",
+				},
+				"global_custom_claim_permissions": map[string]any{
+					"contract_date": map[string]any{
+						"readPermission":  "user_and_admin",
+						"writePermission": "user_and_admin",
+					},
+				},
+			},
+		})
+		return bytes.NewReader(body)
+	}
+
+	t.Run("regular user cannot change admin_only global custom claim value", func(t *testing.T) {
+		app, mockKratos, mockTenant, _ := newApp(t, "admin_only", false)
+
+		req := httptest.NewRequest(http.MethodPut, "/users/u-1", requestBody("2026-07-01"))
+		req.Header.Set("Content-Type", "application/json")
+		resp, err := app.Test(req)
+
+		require.NoError(t, err)
+		require.Equal(t, http.StatusForbidden, resp.StatusCode)
+		mockKratos.AssertNotCalled(t, "UpdateIdentity", mock.Anything, mock.Anything, mock.Anything, mock.Anything)
+		mockKratos.AssertExpectations(t)
+		mockTenant.AssertExpectations(t)
+	})
+
+	t.Run("regular user can change user_and_admin global custom claim value", func(t *testing.T) {
+		app, mockKratos, mockTenant, capturedTraits := newApp(t, "user_and_admin", true)
+
+		req := httptest.NewRequest(http.MethodPut, "/users/u-1", requestBody("2026-07-01"))
+		req.Header.Set("Content-Type", "application/json")
+		resp, err := app.Test(req)
+
+		require.NoError(t, err)
+		require.Equal(t, http.StatusOK, resp.StatusCode)
+		require.NotNil(t, *capturedTraits)
+		claims := (*capturedTraits)["global_custom_claims"].(map[string]any)
+		require.Equal(t, "2026-07-01", claims["contract_date"])
+		permissions := (*capturedTraits)["global_custom_claim_permissions"].(map[string]any)
+		require.Equal(t, map[string]any{
+			"readPermission":  "user_and_admin",
+			"writePermission": "user_and_admin",
+		}, permissions["contract_date"])
+		mockKratos.AssertExpectations(t)
+		mockTenant.AssertExpectations(t)
+	})
+}
+
 func TestUserHandler_UpdateUser_AcceptsDeprecatedAdminRolesAsUser(t *testing.T) {
 	app := fiber.New()
 	mockKratos := new(MockKratosAdmin)
@@ -2569,6 +2778,117 @@ func TestUserHandler_UpdateUserAddTenantKeepsPrimaryAndAddsAppointment(t *testin
 	require.Equal(t, false, added["isPrimary"])
 }
 
+func TestUserHandler_UpdateUserRemoveTenantDropsAdditionalAppointment(t *testing.T) {
+	app := fiber.New()
+	mockKratos := new(MockKratosAdmin)
+	mockTenant := new(MockTenantServiceForUser)
+	mockOutbox := new(userHandlerMockKetoOutboxRepository)
+	h := &UserHandler{
+		KratosAdmin:    mockKratos,
+		TenantService:  mockTenant,
+		KetoOutboxRepo: mockOutbox,
+	}
+	app.Use(func(c *fiber.Ctx) error {
+		c.Locals("user_profile", &domain.UserProfileResponse{
+			ID:   "admin-id",
+			Role: domain.RoleSuperAdmin,
+		})
+		return c.Next()
+	})
+	app.Put("/users/:id", h.UpdateUser)
+
+	mockKratos.On("GetIdentity", mock.Anything, "user-id").Return(&service.KratosIdentity{
+		ID:    "user-id",
+		State: "active",
+		Traits: map[string]any{
+			"email":     "user@test.com",
+			"name":      "Test User",
+			"tenant_id": "primary-tenant-id",
+			"role":      domain.RoleUser,
+			"additionalAppointments": []any{
+				map[string]any{
+					"tenantId":   "primary-tenant-id",
+					"tenantSlug": "primary-tenant",
+					"tenantName": "대표 조직",
+					"isPrimary":  true,
+				},
+				map[string]any{
+					"tenantId":   "private-team-id",
+					"tenantSlug": "private-team",
+					"tenantName": "비공개 팀",
+					"isPrimary":  false,
+				},
+			},
+		},
+	}, nil)
+	mockTenant.On("GetTenantBySlug", mock.Anything, "private-team").Return(&domain.Tenant{
+		ID:   "private-team-id",
+		Name: "비공개 팀",
+		Slug: "private-team",
+		Config: domain.JSONMap{
+			"visibility": "private",
+		},
+	}, nil)
+	mockTenant.On("GetTenant", mock.Anything, "private-team-id").Return(&domain.Tenant{
+		ID:   "private-team-id",
+		Name: "비공개 팀",
+		Slug: "private-team",
+		Config: domain.JSONMap{
+			"visibility": "private",
+		},
+	}, nil).Maybe()
+	mockTenant.On("GetTenant", mock.Anything, "primary-tenant-id").Return(&domain.Tenant{
+		ID:   "primary-tenant-id",
+		Name: "대표 조직",
+		Slug: "primary-tenant",
+	}, nil).Maybe()
+	mockOutbox.On("Create", mock.Anything, mock.MatchedBy(func(entry *domain.KetoOutbox) bool {
+		return entry.Namespace == "Tenant" &&
+			entry.Object == "private-team-id" &&
+			entry.Relation == "members" &&
+			entry.Subject == "User:user-id" &&
+			entry.Action == domain.KetoOutboxActionDelete
+	})).Return(nil).Maybe()
+
+	var capturedTraits map[string]any
+	mockKratos.On("UpdateIdentity", mock.Anything, "user-id", mock.Anything, mock.Anything).Run(func(args mock.Arguments) {
+		capturedTraits = args.Get(2).(map[string]any)
+	}).Return(&service.KratosIdentity{
+		ID:    "user-id",
+		State: "active",
+		Traits: map[string]any{
+			"email":     "user@test.com",
+			"name":      "Test User",
+			"tenant_id": "primary-tenant-id",
+			"role":      domain.RoleUser,
+			"additionalAppointments": []any{
+				map[string]any{
+					"tenantId":   "primary-tenant-id",
+					"tenantSlug": "primary-tenant",
+					"tenantName": "대표 조직",
+					"isPrimary":  true,
+				},
+			},
+		},
+	}, nil)
+
+	body := `{"tenantSlug":"private-team","isRemoveTenant":true}`
+	req := httptest.NewRequest(http.MethodPut, "/users/user-id", strings.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	resp, err := app.Test(req)
+
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+	require.Equal(t, "primary-tenant-id", capturedTraits["tenant_id"])
+	appointments, ok := capturedTraits["additionalAppointments"].([]any)
+	require.True(t, ok)
+	require.Len(t, appointments, 1)
+	remaining := appointments[0].(map[string]any)
+	require.Equal(t, "primary-tenant-id", remaining["tenantId"])
+	require.Equal(t, "primary-tenant", remaining["tenantSlug"])
+	mockOutbox.AssertExpectations(t)
+}
+
 func TestUserHandler_UpdateUserAddTenantRejectsUnmanageableTenantForTenantAdmin(t *testing.T) {
 	app := fiber.New()
 	mockKratos := new(MockKratosAdmin)

backend/internal/service/developer_service.go

@@ -3,7 +3,8 @@ package service
 import (
 	"baron-sso-backend/internal/domain"
 	"context"
-	"errors"
+	"sort"
+	"strings"
 
 	"gorm.io/gorm"
 )
@@ -16,30 +17,179 @@ func NewDeveloperService(db *gorm.DB) *DeveloperService {
 	return &DeveloperService{db: db}
 }
 
-func (s *DeveloperService) RequestAccess(ctx context.Context, req domain.DeveloperRequest) error {
-	// Check if there is already a pending request
-	var existing domain.DeveloperRequest
-	err := s.db.WithContext(ctx).Where("user_id = ? AND tenant_id = ? AND status = ?", req.UserID, req.TenantID, domain.DeveloperRequestStatusPending).First(&existing).Error
-	if err == nil {
+func normalizeDeveloperAccessPages(pages []string) []string {
+	seen := make(map[string]struct{})
+	normalized := make([]string, 0, len(pages))
+
+	add := func(page string) {
+		page = strings.ToLower(strings.TrimSpace(page))
+		if page == "" {
+			return
+		}
+		if page == domain.DeveloperAccessPageAll {
+			normalized = []string{domain.DeveloperAccessPageAll}
+			seen = map[string]struct{}{domain.DeveloperAccessPageAll: {}}
+			return
+		}
+		if page != domain.DeveloperAccessPageOverview &&
+			page != domain.DeveloperAccessPageClientCreate &&
+			page != domain.DeveloperAccessPageAudit {
+			return
+		}
+		if _, exists := seen[page]; exists {
+			return
+		}
+		seen[page] = struct{}{}
+		normalized = append(normalized, page)
+	}
+
+	for _, page := range pages {
+		add(page)
+		if len(normalized) == 1 && normalized[0] == domain.DeveloperAccessPageAll {
+			return normalized
+		}
+	}
+
+	if len(normalized) == 0 {
+		return []string{domain.DeveloperAccessPageAll}
+	}
+
+	sort.SliceStable(normalized, func(i, j int) bool {
+		return accessPageSortIndex(normalized[i]) < accessPageSortIndex(normalized[j])
+	})
+
+	return normalized
+}
+
+func accessPageSortIndex(page string) int {
+	switch page {
+	case domain.DeveloperAccessPageOverview:
+		return 0
+	case domain.DeveloperAccessPageClientCreate:
+		return 1
+	case domain.DeveloperAccessPageAudit:
+		return 2
+	default:
+		return 99
+	}
+}
+
+func accessPagesOverlap(left, right []string) bool {
+	if len(left) == 0 || len(right) == 0 {
+		return false
+	}
+
+	leftSet := make(map[string]struct{}, len(left))
+	for _, page := range normalizeDeveloperAccessPages(left) {
+		if page == domain.DeveloperAccessPageAll {
+			return true
+		}
+		leftSet[page] = struct{}{}
+	}
+
+	for _, page := range normalizeDeveloperAccessPages(right) {
+		if page == domain.DeveloperAccessPageAll {
+			return true
+		}
+		if _, ok := leftSet[page]; ok {
+			return true
+		}
+	}
+
+	return false
+}
+
+func unionDeveloperAccessPages(requests []domain.DeveloperRequest, statuses ...string) []string {
+	statusSet := make(map[string]struct{}, len(statuses))
+	for _, status := range statuses {
+		if trimmed := strings.TrimSpace(status); trimmed != "" {
+			statusSet[trimmed] = struct{}{}
+		}
+	}
+
+	acc := make(map[string]struct{})
+	for _, req := range requests {
+		if len(statusSet) > 0 {
+			if _, ok := statusSet[strings.TrimSpace(req.Status)]; !ok {
+				continue
+			}
+		}
+		pages := normalizeDeveloperAccessPages(req.AccessPages)
+		for _, page := range pages {
+			acc[page] = struct{}{}
+		}
+	}
+
+	if len(acc) == 0 {
 		return nil
 	}
-	if !errors.Is(err, gorm.ErrRecordNotFound) {
+
+	result := make([]string, 0, len(acc))
+	if _, ok := acc[domain.DeveloperAccessPageAll]; ok {
+		return []string{domain.DeveloperAccessPageAll}
+	}
+	for _, page := range domain.DeveloperAccessPageOrder {
+		if _, ok := acc[page]; ok {
+			result = append(result, page)
+		}
+	}
+	return result
+}
+
+func (s *DeveloperService) RequestAccess(ctx context.Context, req domain.DeveloperRequest) error {
+	req.AccessPages = normalizeDeveloperAccessPages(req.AccessPages)
+	// Check if there is already a pending request
+	var existing []domain.DeveloperRequest
+	err := s.db.WithContext(ctx).
+		Where("user_id = ? AND tenant_id = ? AND status = ?", req.UserID, req.TenantID, domain.DeveloperRequestStatusPending).
+		Order("created_at DESC").
+		Find(&existing).Error
+	if err != nil {
 		return err
 	}
+	for _, current := range existing {
+		if accessPagesOverlap(current.AccessPages, req.AccessPages) {
+			return nil
+		}
+	}
 
 	return s.db.WithContext(ctx).Create(&req).Error
 }
 
-func (s *DeveloperService) GetRequestStatus(ctx context.Context, userID, tenantID string) (*domain.DeveloperRequest, error) {
-	var req domain.DeveloperRequest
-	err := s.db.WithContext(ctx).Where("user_id = ? AND tenant_id = ?", userID, tenantID).Order("created_at DESC").First(&req).Error
+func (s *DeveloperService) CreateGrant(ctx context.Context, req domain.DeveloperRequest) error {
+	req.AccessPages = normalizeDeveloperAccessPages(req.AccessPages)
+	return s.db.WithContext(ctx).Create(&req).Error
+}
+
+func (s *DeveloperService) GetRequestStatus(ctx context.Context, userID, tenantID string) (*domain.DeveloperAccessStatus, error) {
+	var requests []domain.DeveloperRequest
+	err := s.db.WithContext(ctx).
+		Where("user_id = ? AND tenant_id = ?", userID, tenantID).
+		Order("created_at DESC").
+		Find(&requests).Error
 	if err != nil {
-		if errors.Is(err, gorm.ErrRecordNotFound) {
-			return nil, nil
-		}
 		return nil, err
 	}
-	return &req, nil
+	if len(requests) == 0 {
+		return &domain.DeveloperAccessStatus{Status: "none"}, nil
+	}
+
+	approvedPages := unionDeveloperAccessPages(requests, domain.DeveloperRequestStatusApproved)
+	pendingPages := unionDeveloperAccessPages(requests, domain.DeveloperRequestStatusPending)
+
+	status := "none"
+	switch {
+	case len(approvedPages) > 0:
+		status = domain.DeveloperRequestStatusApproved
+	case len(pendingPages) > 0:
+		status = domain.DeveloperRequestStatusPending
+	}
+
+	return &domain.DeveloperAccessStatus{
+		Status:        status,
+		ApprovedPages: approvedPages,
+		PendingPages:  pendingPages,
+	}, nil
 }
 
 func (s *DeveloperService) GetRequestByID(ctx context.Context, id uint) (*domain.DeveloperRequest, error) {
@@ -51,7 +201,7 @@ func (s *DeveloperService) GetRequestByID(ctx context.Context, id uint) (*domain
 	return &req, nil
 }
 
-func (s *DeveloperService) ListRequests(ctx context.Context, userID, status string) ([]domain.DeveloperRequest, error) {
+func (s *DeveloperService) ListRequests(ctx context.Context, userID, status, tenantID string) ([]domain.DeveloperRequest, error) {
 	var requests []domain.DeveloperRequest
 	query := s.db.WithContext(ctx)
 	if userID != "" {
@@ -60,6 +210,9 @@ func (s *DeveloperService) ListRequests(ctx context.Context, userID, status stri
 	if status != "" {
 		query = query.Where("status = ?", status)
 	}
+	if tenantID != "" {
+		query = query.Where("tenant_id = ?", tenantID)
+	}
 	err := query.Order("created_at DESC").Find(&requests).Error
 	return requests, err
 }

backend/internal/service/identity_write_service.go

@@ -0,0 +1,79 @@
+package service
+
+import (
+	"baron-sso-backend/internal/domain"
+	"context"
+	"encoding/json"
+	"fmt"
+	"strings"
+	"time"
+)
+
+type IdentityUpdateRequest struct {
+	IdentityID string
+	Traits     map[string]any
+	State      string
+	Reason     string
+	Source     string
+}
+
+type IdentityWriteService interface {
+	GetIdentity(ctx context.Context, identityID string) (*KratosIdentity, error)
+	UpdateIdentity(ctx context.Context, req IdentityUpdateRequest) (*KratosIdentity, error)
+}
+
+type identityWriteService struct {
+	kratos KratosAdminService
+	redis  domain.RedisRepository
+}
+
+func NewIdentityWriteService(kratos KratosAdminService, redis domain.RedisRepository) IdentityWriteService {
+	return &identityWriteService{
+		kratos: kratos,
+		redis:  redis,
+	}
+}
+
+func (s *identityWriteService) GetIdentity(ctx context.Context, identityID string) (*KratosIdentity, error) {
+	if s == nil || s.kratos == nil {
+		return nil, fmt.Errorf("kratos admin service is required")
+	}
+	return s.kratos.GetIdentity(ctx, identityID)
+}
+
+func (s *identityWriteService) UpdateIdentity(ctx context.Context, req IdentityUpdateRequest) (*KratosIdentity, error) {
+	if s == nil || s.kratos == nil {
+		return nil, fmt.Errorf("kratos admin service is required")
+	}
+	updated, err := s.kratos.UpdateIdentity(ctx, req.IdentityID, req.Traits, req.State)
+	if err != nil {
+		return nil, err
+	}
+	_ = s.markIdentityMirrorStale(req)
+	return updated, nil
+}
+
+func (s *identityWriteService) markIdentityMirrorStale(req IdentityUpdateRequest) error {
+	if s == nil || s.redis == nil {
+		return nil
+	}
+	now := time.Now().UTC()
+	reason := strings.TrimSpace(req.Reason)
+	if reason == "" {
+		reason = "identity_write"
+	}
+	source := strings.TrimSpace(req.Source)
+	if source != "" {
+		reason = source + ": " + reason
+	}
+	state := domain.IdentityCacheStatus{
+		Status:    "stale",
+		LastError: reason,
+		UpdatedAt: &now,
+	}
+	raw, err := json.Marshal(state)
+	if err != nil {
+		return err
+	}
+	return s.redis.Set("identity:mirror:state", string(raw), 0)
+}

backend/internal/service/identity_write_service_test.go

@@ -0,0 +1,75 @@
+package service
+
+import (
+	"baron-sso-backend/internal/domain"
+	"context"
+	"encoding/json"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/require"
+)
+
+type identityWriteRedisStub struct {
+	values map[string]string
+}
+
+func (s *identityWriteRedisStub) Set(key string, value string, expiration time.Duration) error {
+	if s.values == nil {
+		s.values = map[string]string{}
+	}
+	s.values[key] = value
+	return nil
+}
+
+func (s *identityWriteRedisStub) Get(key string) (string, error) {
+	return s.values[key], nil
+}
+
+func (s *identityWriteRedisStub) Delete(key string) error {
+	delete(s.values, key)
+	return nil
+}
+
+func (s *identityWriteRedisStub) StoreVerificationCode(phone, code string) error {
+	return nil
+}
+
+func (s *identityWriteRedisStub) GetVerificationCode(phone string) (string, error) {
+	return "", nil
+}
+
+func (s *identityWriteRedisStub) DeleteVerificationCode(phone string) error {
+	return nil
+}
+
+func TestIdentityWriteServiceUpdateIdentityMarksMirrorStale(t *testing.T) {
+	kratos := new(MockKratosAdminServiceShared)
+	redis := &identityWriteRedisStub{}
+	traits := map[string]any{"email": "user@example.com"}
+	kratos.On("UpdateIdentity", mock.Anything, "user-1", traits, "active").Return(&KratosIdentity{
+		ID:     "user-1",
+		State:  "active",
+		Traits: traits,
+	}, nil).Once()
+
+	writer := NewIdentityWriteService(kratos, redis)
+	updated, err := writer.UpdateIdentity(context.Background(), IdentityUpdateRequest{
+		IdentityID: "user-1",
+		Traits:     traits,
+		State:      "active",
+		Reason:     "rp_custom_claims_sync",
+		Source:     "dev_handler",
+	})
+
+	require.NoError(t, err)
+	require.Equal(t, "user-1", updated.ID)
+	rawState := redis.values["identity:mirror:state"]
+	require.NotEmpty(t, rawState)
+	var state domain.IdentityCacheStatus
+	require.NoError(t, json.Unmarshal([]byte(rawState), &state))
+	require.Equal(t, "stale", state.Status)
+	require.Contains(t, state.LastError, "rp_custom_claims_sync")
+	kratos.AssertExpectations(t)
+}

backend/internal/service/worksmobile_client_test.go

@@ -1031,6 +1031,12 @@ func TestCompareWorksmobileUsersIncludesWorksOnlyRowsWithoutExternalIDWhenInclud
 }
 
 func TestCompareWorksmobileGroupsIncludesBaronAndWorksParentOrg(t *testing.T) {
+	t.Setenv("SAMAN_DOMAIN_ID", "")
+	t.Setenv("HANMAC_DOMAIN_ID", "")
+	t.Setenv("GPDTDC_DOMAIN_ID", "")
+	t.Setenv("HALLA_DOMAIN_ID", "")
+	t.Setenv("BARONGROUP_DOMAIN_ID", "")
+
 	parentID := "tenant-parent"
 	childID := "tenant-child"
 	localTenants := []domain.Tenant{

common/config/biome.base.json

@@ -4,6 +4,11 @@
     "enabled": true,
     "indentStyle": "space"
   },
+  "css": {
+    "parser": {
+      "tailwindDirectives": true
+    }
+  },
   "linter": {
     "enabled": true,
     "rules": {
@@ -25,6 +30,7 @@
       "**",
       "!**/dist/**",
       "!**/.vite/**",
+      "!**/.pnpm-store/**",
       "!**/node_modules/**",
       "!**/coverage/**",
       "!**/tsconfig*.json",

common/core/components/audit/AuditLogTable.test.tsx

@@ -1,5 +1,5 @@
-import { act } from "react-dom/test-utils";
 import { createRoot, type Root } from "react-dom/client";
+import { act } from "react-dom/test-utils";
 import { afterEach, describe, expect, it, vi } from "vitest";
 import type { CommonAuditLog } from "../../audit";
 import { AuditLogTable } from "./AuditLogTable";
@@ -128,8 +128,12 @@ describe("AuditLogTable", () => {
     expect(loadMoreButton).toBeTruthy();
 
     await act(async () => {
-      actorCopyButton?.dispatchEvent(new MouseEvent("click", { bubbles: true }));
-      targetCopyButton?.dispatchEvent(new MouseEvent("click", { bubbles: true }));
+      actorCopyButton?.dispatchEvent(
+        new MouseEvent("click", { bubbles: true }),
+      );
+      targetCopyButton?.dispatchEvent(
+        new MouseEvent("click", { bubbles: true }),
+      );
       expandButton?.dispatchEvent(new MouseEvent("click", { bubbles: true }));
     });
 

common/core/components/audit/AuditLogTable.tsx

@@ -1,8 +1,8 @@
 import { ChevronDown, ChevronUp, Copy } from "lucide-react";
 import * as React from "react";
 import {
-  getCommonBadgeClasses,
   type CommonBadgeVariant,
+  getCommonBadgeClasses,
 } from "../../../ui/badge";
 import { getCommonButtonClasses } from "../../../ui/button";
 import {
@@ -90,7 +90,12 @@ export function AuditLogTable({
         <div className={commonTableWrapperClass}>
           <Table className={commonTableClass}>
             <TableHeader className={commonTableHeaderClass}>
-              <TableRow className={cx(commonTableRowClass, commonStickyTableHeaderClass)}>
+              <TableRow
+                className={cx(
+                  commonTableRowClass,
+                  commonStickyTableHeaderClass,
+                )}
+              >
                 <TableHead className={cx(commonTableHeadClass, "w-[190px]")}>
                   {t("ui.common.audit.table.time", "Time")}
                 </TableHead>
@@ -122,7 +127,12 @@ export function AuditLogTable({
                 return (
                   <React.Fragment key={rowKey}>
                     <TableRow className={cx(commonTableRowClass, "bg-card/40")}>
-                      <TableCell className={cx(commonTableCellClass, "text-xs text-muted-foreground")}>
+                      <TableCell
+                        className={cx(
+                          commonTableCellClass,
+                          "text-xs text-muted-foreground",
+                        )}
+                      >
                         <div className="space-y-1">
                           <div>{date}</div>
                           <div>{time}</div>
@@ -154,12 +164,22 @@ export function AuditLogTable({
                           ) : null}
                         </div>
                       </TableCell>
-                      <TableCell className={cx(commonTableCellClass, "text-xs text-muted-foreground")}>
+                      <TableCell
+                        className={cx(
+                          commonTableCellClass,
+                          "text-xs text-muted-foreground",
+                        )}
+                      >
                         <div className="font-semibold text-foreground">
                           {actionLabel}
                         </div>
                       </TableCell>
-                      <TableCell className={cx(commonTableCellClass, "text-xs text-muted-foreground")}>
+                      <TableCell
+                        className={cx(
+                          commonTableCellClass,
+                          "text-xs text-muted-foreground",
+                        )}
+                      >
                         <div className="flex items-center gap-2">
                           <span className="break-all">{targetLabel}</span>
                           {targetLabel !== "-" ? (
@@ -192,7 +212,9 @@ export function AuditLogTable({
                           {log.status}
                         </span>
                       </TableCell>
-                      <TableCell className={cx(commonTableCellClass, "text-right")}>
+                      <TableCell
+                        className={cx(commonTableCellClass, "text-right")}
+                      >
                         <button
                           type="button"
                           className={getCommonButtonClasses({
@@ -215,18 +237,28 @@ export function AuditLogTable({
                       </TableCell>
                     </TableRow>
                     {expanded && (
-                      <TableRow className={cx(commonTableRowClass, "bg-card/20")}>
-                        <TableCell colSpan={6} className={cx(commonTableCellClass, "text-xs")}>
+                      <TableRow
+                        className={cx(commonTableRowClass, "bg-card/20")}
+                      >
+                        <TableCell
+                          colSpan={6}
+                          className={cx(commonTableCellClass, "text-xs")}
+                        >
                           <div className="grid gap-4 text-muted-foreground md:grid-cols-3">
                             <div className="space-y-1">
                               <div className="uppercase tracking-[0.16em]">
-                                {t("ui.common.audit.details.request", "Request")}
+                                {t(
+                                  "ui.common.audit.details.request",
+                                  "Request",
+                                )}
                               </div>
                               <div className="break-all">
                                 {t(
                                   "ui.common.audit.details.request_id",
                                   "Request ID · {{value}}",
-                                  { value: formatAuditValue(details.request_id) },
+                                  {
+                                    value: formatAuditValue(details.request_id),
+                                  },
                                 )}
                               </div>
                               <div className="break-all">
@@ -237,9 +269,13 @@ export function AuditLogTable({
                                 )}
                               </div>
                               <div>
-                                {t("ui.common.audit.details.ip", "IP · {{value}}", {
-                                  value: formatAuditValue(log.ip_address),
-                                })}
+                                {t(
+                                  "ui.common.audit.details.ip",
+                                  "IP · {{value}}",
+                                  {
+                                    value: formatAuditValue(log.ip_address),
+                                  },
+                                )}
                               </div>
                               <div className="break-all">
                                 {t(
@@ -283,7 +319,9 @@ export function AuditLogTable({
                                 {t(
                                   "ui.common.audit.details.tenant",
                                   "Tenant · {{value}}",
-                                  { value: formatAuditValue(details.tenant_id) },
+                                  {
+                                    value: formatAuditValue(details.tenant_id),
+                                  },
                                 )}
                               </div>
                               <div>
@@ -384,26 +422,74 @@ export function AuditLogTable({
 }
 
 // Internal table components for cleaner implementation
-function Table({ className, children, style }: { className?: string, children: React.ReactNode, style?: React.CSSProperties }) {
-  return <table className={className} style={style}>{children}</table>;
+function Table({
+  className,
+  children,
+  style,
+}: {
+  className?: string;
+  children: React.ReactNode;
+  style?: React.CSSProperties;
+}) {
+  return (
+    <table className={className} style={style}>
+      {children}
+    </table>
+  );
 }
 
-function TableHeader({ className, children }: { className?: string, children: React.ReactNode }) {
+function TableHeader({
+  className,
+  children,
+}: {
+  className?: string;
+  children: React.ReactNode;
+}) {
   return <thead className={className}>{children}</thead>;
 }
 
-function TableBody({ className, children }: { className?: string, children: React.ReactNode }) {
+function TableBody({
+  className,
+  children,
+}: {
+  className?: string;
+  children: React.ReactNode;
+}) {
   return <tbody className={className}>{children}</tbody>;
 }
 
-function TableRow({ className, children }: { className?: string, children: React.ReactNode }) {
+function TableRow({
+  className,
+  children,
+}: {
+  className?: string;
+  children: React.ReactNode;
+}) {
   return <tr className={className}>{children}</tr>;
 }
 
-function TableHead({ className, children }: { className?: string, children?: React.ReactNode }) {
+function TableHead({
+  className,
+  children,
+}: {
+  className?: string;
+  children?: React.ReactNode;
+}) {
   return <th className={className}>{children}</th>;
 }
 
-function TableCell({ className, children, colSpan }: { className?: string, children: React.ReactNode, colSpan?: number }) {
-  return <td className={className} colSpan={colSpan}>{children}</td>;
+function TableCell({
+  className,
+  children,
+  colSpan,
+}: {
+  className?: string;
+  children: React.ReactNode;
+  colSpan?: number;
+}) {
+  return (
+    <td className={className} colSpan={colSpan}>
+      {children}
+    </td>
+  );
 }

devfront/src/app/routes.tsx

@@ -9,6 +9,7 @@ import ClientDetailsPage from "../features/clients/ClientDetailsPage";
 import ClientGeneralPage from "../features/clients/ClientGeneralPage";
 import ClientRelationsPage from "../features/clients/ClientRelationsPage";
 import ClientsPage from "../features/clients/ClientsPage";
+import DeveloperGrantsPage from "../features/developer-grants/DeveloperGrantsPage";
 import DeveloperRequestPage from "../features/developer-request/DeveloperRequestPage";
 import GlobalOverviewPage from "../features/overview/GlobalOverviewPage";
 import ProfilePage from "../features/profile/ProfilePage";
@@ -26,6 +27,7 @@ const devFrontAppChildren: RouteObject[] = [
     element: <ClientRelationsPage />,
   },
   { path: "developer-requests", element: <DeveloperRequestPage /> },
+  { path: "developer-grants", element: <DeveloperGrantsPage /> },
   { path: "audit-logs", element: <AuditLogsPage /> },
   { path: "profile", element: <ProfilePage /> },
 ];

devfront/src/components/common/ForbiddenMessage.test.tsx

@@ -65,17 +65,9 @@ describe("ForbiddenMessage", () => {
     expect(clients.textContent).toContain("target application");
   });
 
-  it("renders specific guidance for privileged admin roles", async () => {
-    authState.user.profile.role = "rp_admin";
-    const rpAdmin = await renderMessage("clients");
-    expect(rpAdmin.textContent).toContain(
-      "RP administrators can only access resources for their assigned applications.",
-    );
-
-    authState.user.profile.role = "tenant_admin";
-    const tenantAdmin = await renderMessage("clients");
-    expect(tenantAdmin.textContent).toContain(
-      "Tenant administrator permissions are not configured correctly or have expired.",
-    );
+  it("falls back to the default message for non-user roles", async () => {
+    authState.user.profile.role = "super_admin";
+    const admin = await renderMessage("clients");
+    expect(admin.textContent).toContain("You do not have permission");
   });
 });

devfront/src/components/common/ForbiddenMessage.tsx

@@ -34,16 +34,6 @@ export function ForbiddenMessage({ resourceToken }: Props) {
         "Standard user accounts can use this feature only when an operational or administrative relationship is granted for the target application. Request access from an administrator if needed.",
       );
     }
-  } else if (role === "rp_admin") {
-    explanation = t(
-      "msg.dev.forbidden.rp_admin",
-      "RP administrators can only access resources for their assigned applications.",
-    );
-  } else if (role === "tenant_admin") {
-    explanation = t(
-      "msg.dev.forbidden.tenant_admin",
-      "Tenant administrator permissions are not configured correctly or have expired.",
-    );
   }
 
   const resourceLabel =

devfront/src/components/layout/AppLayout.tsx

@@ -2,6 +2,7 @@ import { useQuery } from "@tanstack/react-query";
 import {
   ChevronDown,
   ClipboardCheck,
+  KeyRound,
   LayoutDashboard,
   LogOut,
   Moon,
@@ -39,7 +40,7 @@ import { Toaster } from "../ui/toaster";
 
 const LOCALE_CHANGED_EVENT = "baron_locale_changed";
 
-const navItems: ShellSidebarNavItem[] = [
+const baseNavItems: ShellSidebarNavItem[] = [
   {
     labelKey: "ui.dev.nav.overview",
     labelFallback: "Overview",
@@ -350,6 +351,18 @@ function AppLayout() {
     auth.user?.profile as Record<string, unknown> | undefined,
   );
   const displayRoleKey = profile?.role || currentRole;
+  const navItems =
+    displayRoleKey === "super_admin"
+      ? [
+          ...baseNavItems,
+          {
+            labelKey: "ui.dev.nav.developer_grants",
+            labelFallback: "Developer Access Grants",
+            to: "/developer-grants",
+            icon: KeyRound,
+          },
+        ]
+      : baseNavItems;
   const handleSessionExpiryToggle = () => {
     setIsSessionExpiryEnabled((prev) => {
       const next = !prev;

devfront/src/features/audit/AuditLogsPage.test.tsx

@@ -174,6 +174,22 @@ describe("AuditLogsPage", () => {
     expect(navigateMock).toHaveBeenCalledWith("/developer-requests");
   });
 
+  it("renders the generic access request card when tenant context is missing", async () => {
+    gateState = {
+      hasDeveloperAccess: false,
+      isDeveloperRequestPending: false,
+      canRequestDeveloperAccess: true,
+      isLoadingDeveloperAccessGate: false,
+      isTenantContextMissing: true,
+    };
+
+    const container = await renderPage();
+    expect(container.textContent).toContain(
+      "감사 로그는 개발자 권한이 있어야 볼 수 있습니다.",
+    );
+    expect(container.textContent).toContain("개발자 권한 신청");
+  });
+
   it("exports the fetched logs as CSV", async () => {
     const createObjectURL = vi
       .spyOn(URL, "createObjectURL")

devfront/src/features/audit/AuditLogsPage.tsx

@@ -101,6 +101,7 @@ function AuditLogsPage() {
     hasAccessToken,
     profileRole,
     tenantId,
+    requiredPages: ["audit"],
     isLoadingIdentity: isLoadingMe,
   });
 

devfront/src/features/clients/ClientConsentsPage.test.tsx

@@ -0,0 +1,285 @@
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import { act } from "react";
+import { createRoot, type Root } from "react-dom/client";
+import { MemoryRouter, Route, Routes } from "react-router-dom";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import ClientConsentsPage from "./ClientConsentsPage";
+
+const fetchClientMock = vi.fn();
+const fetchConsentsMock = vi.fn();
+const fetchRPUserMetadataMock = vi.fn();
+const updateRPUserMetadataMock = vi.fn();
+const revokeConsentMock = vi.fn();
+
+vi.mock("../../lib/devApi", () => ({
+  fetchClient: (...args: unknown[]) => fetchClientMock(...args),
+  fetchConsents: (...args: unknown[]) => fetchConsentsMock(...args),
+  fetchRPUserMetadata: (...args: unknown[]) => fetchRPUserMetadataMock(...args),
+  updateRPUserMetadata: (...args: unknown[]) =>
+    updateRPUserMetadataMock(...args),
+  revokeConsent: (...args: unknown[]) => revokeConsentMock(...args),
+}));
+
+vi.mock("../../lib/i18n", () => ({
+  t: (key: string, fallback?: string, vars?: Record<string, unknown>) => {
+    let text = fallback ?? key;
+    for (const [name, value] of Object.entries(vars ?? {})) {
+      text = text.replaceAll(`{{${name}}}`, String(value));
+    }
+    return text;
+  },
+}));
+
+const roots: Root[] = [];
+
+const clientDetail = {
+  client: {
+    id: "client-a",
+    name: "Claims App",
+    type: "private" as const,
+    status: "active" as const,
+    redirectUris: ["https://rp.example.com/callback"],
+    scopes: ["openid", "profile"],
+    tokenEndpointAuthMethod: "client_secret_basic",
+    metadata: {
+      id_token_claims: [
+        {
+          namespace: "rp_claims",
+          key: "license",
+          value: "12345678",
+          valueType: "text",
+          readPermission: "admin_only",
+          writePermission: "admin_only",
+        },
+      ],
+    },
+  },
+  endpoints: {
+    discovery: "https://issuer/.well-known/openid-configuration",
+    issuer: "https://issuer",
+    authorization: "https://issuer/oauth2/auth",
+    token: "https://issuer/oauth2/token",
+    userinfo: "https://issuer/userinfo",
+  },
+};
+
+function buildMetadata() {
+  return {
+    license: "abcd",
+    license_permissions: {
+      readPermission: "user_and_admin",
+      writePermission: "admin_only",
+    },
+  };
+}
+
+async function flush() {
+  await act(async () => {
+    await new Promise((resolve) => setTimeout(resolve, 0));
+  });
+}
+
+async function renderPage() {
+  const container = document.createElement("div");
+  document.body.appendChild(container);
+  const root = createRoot(container);
+  roots.push(root);
+  const queryClient = new QueryClient({
+    defaultOptions: {
+      queries: { retry: false },
+      mutations: { retry: false },
+    },
+  });
+
+  await act(async () => {
+    root.render(
+      <QueryClientProvider client={queryClient}>
+        <MemoryRouter initialEntries={["/clients/client-a/consents"]}>
+          <Routes>
+            <Route
+              path="/clients/:id/consents"
+              element={<ClientConsentsPage />}
+            />
+          </Routes>
+        </MemoryRouter>
+      </QueryClientProvider>,
+    );
+  });
+  await flush();
+
+  return { container };
+}
+
+describe("ClientConsentsPage RP custom claims", () => {
+  beforeEach(() => {
+    fetchClientMock.mockResolvedValue(clientDetail);
+    fetchConsentsMock.mockResolvedValue({
+      items: [
+        {
+          subject: "user-1",
+          userName: "Consent User",
+          clientId: "client-a",
+          clientName: "Claims App",
+          grantedScopes: ["openid", "profile"],
+          authenticatedAt: "2026-06-11T09:00:00Z",
+          createdAt: "2026-06-10T09:00:00Z",
+          status: "active",
+          tenantId: "tenant-1",
+          tenantName: "Hanmac",
+          rpMetadata: buildMetadata(),
+        },
+      ],
+    });
+    fetchRPUserMetadataMock.mockResolvedValue({
+      clientId: "client-a",
+      userId: "user-1",
+      metadata: buildMetadata(),
+    });
+    updateRPUserMetadataMock.mockResolvedValue({
+      clientId: "client-a",
+      userId: "user-1",
+      metadata: buildMetadata(),
+    });
+    revokeConsentMock.mockResolvedValue(undefined);
+  });
+
+  afterEach(() => {
+    for (const root of roots.splice(0)) {
+      act(() => {
+        root.unmount();
+      });
+    }
+    vi.clearAllMocks();
+    document.body.innerHTML = "";
+  });
+
+  it("removes the RP custom claim permission selectors while keeping claim data editable", async () => {
+    const { container } = await renderPage();
+
+    const editButton = Array.from(container.querySelectorAll("button")).find(
+      (button) =>
+        button.textContent?.includes("사용자 Claim 설정") ||
+        button.textContent?.includes("User Claim Settings"),
+    );
+    expect(editButton).toBeDefined();
+
+    await act(async () => {
+      editButton?.dispatchEvent(new MouseEvent("click", { bubbles: true }));
+    });
+    await flush();
+
+    expect(
+      container.querySelectorAll('select[aria-label="읽기 권한"]'),
+    ).toHaveLength(0);
+    expect(
+      container.querySelectorAll('select[aria-label="쓰기 권한"]'),
+    ).toHaveLength(0);
+    expect(container.textContent).toContain("license");
+    expect(container.textContent).toContain("abcd");
+
+    const saveButton = Array.from(container.querySelectorAll("button")).find(
+      (button) =>
+        button.textContent?.includes("Claim 저장") ||
+        button.textContent?.includes("Save"),
+    );
+    expect(saveButton).toBeDefined();
+
+    await act(async () => {
+      saveButton?.dispatchEvent(new MouseEvent("click", { bubbles: true }));
+    });
+    await flush();
+
+    expect(updateRPUserMetadataMock).toHaveBeenCalledWith(
+      "client-a",
+      "user-1",
+      expect.objectContaining({
+        license: "abcd",
+        license_permissions: {
+          readPermission: "user_and_admin",
+          writePermission: "admin_only",
+        },
+      }),
+    );
+  });
+
+  it("keeps date claim inputs and timezone selectors on the same row", async () => {
+    fetchClientMock.mockResolvedValue({
+      ...clientDetail,
+      client: {
+        ...clientDetail.client,
+        metadata: {
+          id_token_claims: [
+            {
+              namespace: "rp_claims",
+              key: "contract_date",
+              value: "",
+              valueType: "date",
+              readPermission: "admin_only",
+              writePermission: "admin_only",
+            },
+          ],
+        },
+      },
+    });
+    fetchConsentsMock.mockResolvedValue({
+      items: [
+        {
+          subject: "user-1",
+          userName: "Consent User",
+          clientId: "client-a",
+          clientName: "Claims App",
+          grantedScopes: ["openid", "profile"],
+          authenticatedAt: "2026-06-11T09:00:00Z",
+          createdAt: "2026-06-10T09:00:00Z",
+          status: "active",
+          tenantId: "tenant-1",
+          tenantName: "Hanmac",
+          rpMetadata: {
+            contract_date: 1781017200,
+            contract_date_permissions: {
+              readPermission: "admin_only",
+              writePermission: "admin_only",
+            },
+          },
+        },
+      ],
+    });
+    fetchRPUserMetadataMock.mockResolvedValue({
+      clientId: "client-a",
+      userId: "user-1",
+      metadata: {
+        contract_date: 1781017200,
+        contract_date_permissions: {
+          readPermission: "admin_only",
+          writePermission: "admin_only",
+        },
+      },
+    });
+
+    const { container } = await renderPage();
+
+    const editButton = Array.from(container.querySelectorAll("button")).find(
+      (button) =>
+        button.textContent?.includes("사용자 Claim 설정") ||
+        button.textContent?.includes("User Claim Settings"),
+    );
+
+    await act(async () => {
+      editButton?.dispatchEvent(new MouseEvent("click", { bubbles: true }));
+    });
+    await flush();
+
+    const dateInput = container.querySelector(
+      'input[aria-label="contract_date date"]',
+    );
+    const timeZoneSelect = container.querySelector(
+      'select[aria-label="contract_date timezone"]',
+    );
+
+    expect(dateInput).not.toBeNull();
+    expect(timeZoneSelect).not.toBeNull();
+    expect(dateInput?.parentElement).toBe(timeZoneSelect?.parentElement);
+    expect(dateInput?.parentElement?.className).toContain("items-center");
+    expect(dateInput?.parentElement?.className).not.toContain("flex-col");
+  });
+});

devfront/src/features/clients/ClientConsentsPage.tsx

@@ -37,6 +37,7 @@ import {
   TableHeader,
   TableRow,
 } from "../../components/ui/table";
+import { Textarea } from "../../components/ui/textarea";
 import {
   fetchClient,
   fetchConsents,
@@ -47,10 +48,17 @@ import {
 import { t } from "../../lib/i18n";
 import { cn } from "../../lib/utils";
 import { ClientDetailTabs } from "./ClientDetailTabs";
+import {
+  claimDateTimeValueToInputString,
+  dateTimeInputToUnixSeconds,
+  getBrowserTimeZone,
+  getSupportedTimeZones,
+} from "./rpClaimDateTime";
 
 type RPClaimValueType =
   | "text"
   | "number"
+  | "float"
   | "boolean"
   | "array"
   | "object"
@@ -70,6 +78,7 @@ type MetadataDraftRow = {
   id: string;
   key: string;
   value: string;
+  timeZone: string;
   valueType: RPClaimValueType;
   readPermission: CustomClaimPermission;
   writePermission: CustomClaimPermission;
@@ -99,6 +108,7 @@ function readPermissionMetadata(
 function metadataToDraftRows(
   metadata: Record<string, unknown> | undefined,
   schemas: RPClaimSchema[],
+  defaultTimeZone = getBrowserTimeZone(),
 ): MetadataDraftRow[] {
   if (schemas.length > 0) {
     return schemas.map((schema) => ({
@@ -108,7 +118,9 @@ function metadataToDraftRows(
         metadata?.[schema.key],
         schema.value,
         schema.valueType,
+        defaultTimeZone,
       ),
+      timeZone: defaultTimeZone,
       valueType: schema.valueType,
       readPermission: readPermissionMetadata(
         metadata,
@@ -132,6 +144,7 @@ function metadataToDraftRows(
       id: `${key}-${index}`,
       key,
       value: metadataValueToString(value, ""),
+      timeZone: defaultTimeZone,
       valueType: "text",
       readPermission: readPermissionMetadata(
         metadata,
@@ -154,7 +167,7 @@ function draftRowsToMetadata(rows: MetadataDraftRow[]) {
   for (const row of rows) {
     const key = row.key.trim();
     if (!key) continue;
-    metadata[key] = row.value.trim();
+    metadata[key] = draftRowValueToMetadataValue(row);
     metadata[`${key}_permissions`] = {
       readPermission: row.readPermission,
       writePermission: row.writePermission,
@@ -163,10 +176,50 @@ function draftRowsToMetadata(rows: MetadataDraftRow[]) {
   return metadata;
 }
 
+function draftRowValueToMetadataValue(row: MetadataDraftRow) {
+  const value = row.value.trim();
+  switch (row.valueType) {
+    case "number":
+      return /^-?\d+$/.test(value) ? Number.parseInt(value, 10) : value;
+    case "float": {
+      const parsed = Number(value);
+      return Number.isFinite(parsed) ? parsed : value;
+    }
+    case "boolean":
+      return value === "true";
+    case "date":
+    case "datetime":
+      return (
+        dateTimeInputToUnixSeconds(value, row.valueType, row.timeZone) ?? value
+      );
+    case "array":
+      if (value === "") return [];
+      try {
+        const parsed = JSON.parse(value);
+        return Array.isArray(parsed) ? parsed : value;
+      } catch {
+        return value;
+      }
+    case "object":
+      if (value === "") return {};
+      try {
+        const parsed = JSON.parse(value);
+        return parsed && typeof parsed === "object" && !Array.isArray(parsed)
+          ? parsed
+          : value;
+      } catch {
+        return value;
+      }
+    default:
+      return value;
+  }
+}
+
 function isRPClaimValueType(value: string): value is RPClaimValueType {
   return (
     value === "text" ||
     value === "number" ||
+    value === "float" ||
     value === "boolean" ||
     value === "array" ||
     value === "object" ||
@@ -188,14 +241,20 @@ function metadataValueToInputString(
   value: unknown,
   fallback: string,
   valueType: RPClaimValueType,
+  timeZone: string,
 ) {
-  const text = metadataValueToString(value, fallback);
   if (valueType === "date") {
-    return text.slice(0, 10);
+    return claimDateTimeValueToInputString(value, fallback, "date", timeZone);
   }
   if (valueType === "datetime") {
-    return text.slice(0, 16);
+    return claimDateTimeValueToInputString(
+      value,
+      fallback,
+      "datetime",
+      timeZone,
+    );
   }
+  const text = metadataValueToString(value, fallback);
   return text;
 }
 
@@ -235,10 +294,21 @@ function readRPClaimSchemas(
 function rpClaimInputType(valueType: RPClaimValueType) {
   if (valueType === "date") return "date";
   if (valueType === "datetime") return "datetime-local";
-  if (valueType === "number") return "number";
   return "text";
 }
 
+function rpClaimInputMode(valueType: RPClaimValueType) {
+  if (valueType === "number") return "numeric";
+  if (valueType === "float") return "decimal";
+  return undefined;
+}
+
+function rpClaimInputPattern(valueType: RPClaimValueType) {
+  if (valueType === "number") return "-?[0-9]*";
+  if (valueType === "float") return "-?(?:[0-9]+(?:\\.[0-9]+)?|\\.[0-9]+)";
+  return undefined;
+}
+
 function ClientConsentsPage() {
   const params = useParams();
   const clientId = params.id ?? "";
@@ -251,6 +321,11 @@ function ClientConsentsPage() {
   const [metadataDraftRows, setMetadataDraftRows] = useState<
     MetadataDraftRow[]
   >([]);
+  const browserTimeZone = useMemo(() => getBrowserTimeZone(), []);
+  const timeZoneOptions = useMemo(
+    () => getSupportedTimeZones(browserTimeZone),
+    [browserTimeZone],
+  );
 
   const { data: clientData } = useQuery({
     queryKey: ["client", clientId],
@@ -303,10 +378,14 @@ function ClientConsentsPage() {
   useEffect(() => {
     if (metadataQuery.data) {
       setMetadataDraftRows(
-        metadataToDraftRows(metadataQuery.data.metadata, rpClaimSchemas),
+        metadataToDraftRows(
+          metadataQuery.data.metadata,
+          rpClaimSchemas,
+          browserTimeZone,
+        ),
       );
     }
-  }, [metadataQuery.data, rpClaimSchemas]);
+  }, [browserTimeZone, metadataQuery.data, rpClaimSchemas]);
 
   const handleRevoke = (sub: string) => {
     if (
@@ -419,25 +498,6 @@ function ClientConsentsPage() {
     );
   };
 
-  const addMetadataDraftRow = () => {
-    setMetadataDraftRows((current) => [
-      ...current,
-      {
-        id: `rp-metadata-${Date.now()}`,
-        key: "",
-        value: "",
-        valueType: "text",
-        readPermission: "admin_only",
-        writePermission: "admin_only",
-        schemaBacked: false,
-      },
-    ]);
-  };
-
-  const removeMetadataDraftRow = (id: string) => {
-    setMetadataDraftRows((current) => current.filter((row) => row.id !== id));
-  };
-
   if (error) {
     const axiosError = error as AxiosError<{ error?: string }>;
     if (axiosError.response?.status === 403) {
@@ -925,16 +985,6 @@ function ClientConsentsPage() {
                 </p>
               </div>
               <div className="flex gap-2">
-                {rpClaimSchemas.length === 0 && (
-                  <Button
-                    variant="outline"
-                    className="gap-2"
-                    onClick={addMetadataDraftRow}
-                  >
-                    <Edit3 className="h-4 w-4" />
-                    {t("ui.common.add", "추가")}
-                  </Button>
-                )}
                 <Button
                   variant="ghost"
                   className="gap-2"
@@ -973,111 +1023,95 @@ function ClientConsentsPage() {
               metadataDraftRows.map((row) => (
                 <div
                   key={row.id}
-                  className="grid gap-3 md:grid-cols-[minmax(180px,0.8fr)_minmax(220px,1fr)_150px_150px_auto]"
+                  className="grid gap-3 md:items-center md:grid-cols-[180px_minmax(220px,320px)_88px]"
                 >
-                  {row.schemaBacked ? (
-                    <div className="flex h-10 items-center rounded-md border bg-muted/30 px-3 font-mono text-xs">
-                      {row.key}
-                    </div>
-                  ) : (
-                    <Input
-                      value={row.key}
+                  <div className="flex h-10 items-center rounded-md border bg-muted/30 px-3 font-mono text-xs">
+                    {row.key}
+                  </div>
+                  {row.valueType === "boolean" ? (
+                    <select
+                      value={row.value === "false" ? "false" : "true"}
                       onChange={(event) =>
                         updateMetadataDraftRow(row.id, {
-                          key: event.target.value,
+                          value: event.target.value,
                         })
                       }
-                      className="font-mono text-xs"
-                      placeholder={t(
-                        "ui.dev.clients.consents.rp_claims.key_placeholder",
-                        "claim_key",
-                      )}
+                      className="h-10 w-full max-w-[180px] rounded-md border border-input bg-background px-3 font-mono text-xs shadow-sm focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring"
+                      aria-label={`${row.key} boolean`}
+                    >
+                      <option value="true">true</option>
+                      <option value="false">false</option>
+                    </select>
+                  ) : row.valueType === "array" ||
+                    row.valueType === "object" ? (
+                    <Textarea
+                      value={row.value}
+                      onChange={(event) =>
+                        updateMetadataDraftRow(row.id, {
+                          value: event.target.value,
+                        })
+                      }
+                      placeholder={
+                        row.valueType === "array"
+                          ? `["value"]`
+                          : `{"key": "value"}`
+                      }
+                      className="min-h-10 w-full max-w-[320px] font-mono text-xs"
+                      aria-label={`${row.key} ${row.valueType}`}
                     />
-                  )}
-                  <Input
-                    type={rpClaimInputType(row.valueType)}
-                    value={row.value}
-                    onChange={(event) =>
-                      updateMetadataDraftRow(row.id, {
-                        value: event.target.value,
-                      })
-                    }
-                    className="font-mono text-xs"
-                    placeholder={t(
-                      "ui.dev.clients.consents.rp_claims.value_placeholder",
-                      "claim value",
-                    )}
-                  />
-                  <select
-                    value={row.readPermission}
-                    onChange={(event) =>
-                      updateMetadataDraftRow(row.id, {
-                        readPermission: event.target
-                          .value as CustomClaimPermission,
-                      })
-                    }
-                    className="h-10 rounded-md border border-input bg-background px-3 text-sm shadow-sm focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring"
-                    aria-label={t(
-                      "ui.dev.clients.consents.rp_claims.read_permission",
-                      "읽기 권한",
-                    )}
-                  >
-                    <option value="admin_only">
-                      {t(
-                        "ui.common.custom_claim_permission.admin_only",
-                        "관리자만 가능",
-                      )}
-                    </option>
-                    <option value="user_and_admin">
-                      {t(
-                        "ui.common.custom_claim_permission.user_and_admin",
-                        "사용자 및 관리자 가능",
-                      )}
-                    </option>
-                  </select>
-                  <select
-                    value={row.writePermission}
-                    onChange={(event) =>
-                      updateMetadataDraftRow(row.id, {
-                        writePermission: event.target
-                          .value as CustomClaimPermission,
-                      })
-                    }
-                    className="h-10 rounded-md border border-input bg-background px-3 text-sm shadow-sm focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring"
-                    aria-label={t(
-                      "ui.dev.clients.consents.rp_claims.write_permission",
-                      "쓰기 권한",
-                    )}
-                  >
-                    <option value="admin_only">
-                      {t(
-                        "ui.common.custom_claim_permission.admin_only",
-                        "관리자만 가능",
-                      )}
-                    </option>
-                    <option value="user_and_admin">
-                      {t(
-                        "ui.common.custom_claim_permission.user_and_admin",
-                        "사용자 및 관리자 가능",
-                      )}
-                    </option>
-                  </select>
-                  {row.schemaBacked ? (
-                    <Badge
-                      variant="muted"
-                      className="h-10 justify-center rounded-md px-3 font-mono text-xs"
-                    >
-                      {row.valueType}
-                    </Badge>
                   ) : (
-                    <Button
-                      variant="ghost"
-                      size="icon"
-                      onClick={() => removeMetadataDraftRow(row.id)}
+                    <div
+                      className={cn(
+                        "flex gap-2",
+                        row.valueType === "date" || row.valueType === "datetime"
+                          ? "items-center"
+                          : "flex-col",
+                      )}
                     >
-                      <X className="h-4 w-4" />
-                    </Button>
+                      <Input
+                        type={rpClaimInputType(row.valueType)}
+                        inputMode={rpClaimInputMode(row.valueType)}
+                        pattern={rpClaimInputPattern(row.valueType)}
+                        value={row.value}
+                        onChange={(event) =>
+                          updateMetadataDraftRow(row.id, {
+                            value: event.target.value,
+                          })
+                        }
+                        className="w-full max-w-[320px] font-mono text-xs"
+                        placeholder={t(
+                          "ui.dev.clients.consents.rp_claims.value_placeholder",
+                          "claim value",
+                        )}
+                        aria-label={`${row.key} ${row.valueType}`}
+                      />
+                      {(row.valueType === "date" ||
+                        row.valueType === "datetime") && (
+                        <select
+                          value={row.timeZone}
+                          onChange={(event) =>
+                            updateMetadataDraftRow(row.id, {
+                              timeZone: event.target.value,
+                            })
+                          }
+                          className="h-10 min-w-[160px] rounded-md border border-input bg-background px-3 font-mono text-xs shadow-sm focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring"
+                          aria-label={`${row.key} timezone`}
+                        >
+                          {timeZoneOptions.map((timeZone) => (
+                            <option key={timeZone} value={timeZone}>
+                              {timeZone}
+                            </option>
+                          ))}
+                        </select>
+                      )}
+                    </div>
                   )}
+                  <Badge
+                    variant="muted"
+                    className="h-10 w-fit justify-center rounded-md px-3 font-mono text-xs"
+                  >
+                    {row.valueType}
+                  </Badge>
                 </div>
               ))
             )}

devfront/src/features/clients/ClientDetailTabs.test.tsx

@@ -7,7 +7,7 @@ vi.mock("../../lib/i18n", () => ({
   t: (key: string, fallback?: string) =>
     ({
       "ui.dev.clients.details.tab.connection": "연동 설정",
-      "ui.dev.clients.details.tab.user_claims": "사용자 Claim",
+      "ui.dev.clients.details.tab.consents": "Consents & Claims",
       "ui.dev.clients.details.tab.settings": "설정",
       "ui.dev.clients.details.tab.relationships": "관계",
     })[key] ??
@@ -23,7 +23,7 @@ describe("ClientDetailTabs", () => {
       </MemoryRouter>,
     );
 
-    expect(html).toContain("사용자 Claim");
+    expect(html).toContain("Consents &amp; Claims");
     expect(html).toContain('href="/clients/client-a/consents"');
   });
 });

devfront/src/features/clients/ClientDetailTabs.tsx

@@ -18,7 +18,6 @@ const tabOrder: Array<{
   {
     key: "consents",
     href: (clientId) => `/clients/${clientId}/consents`,
-    labelKey: "ui.dev.clients.details.tab.user_claims",
   },
   { key: "settings", href: (clientId) => `/clients/${clientId}/settings` },
   {

devfront/src/features/clients/ClientGeneralPage.claims.test.tsx

@@ -0,0 +1,654 @@
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import { act } from "react";
+import { createRoot, type Root } from "react-dom/client";
+import { MemoryRouter, Route, Routes } from "react-router-dom";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import type { ClientDetailResponse } from "../../lib/devApi";
+import ClientGeneralPage from "./ClientGeneralPage";
+
+const navigateMock = vi.fn();
+const fetchClientMock = vi.fn();
+const updateClientMock = vi.fn();
+const fetchClientRelationsMock = vi.fn();
+const fetchMyTenantsMock = vi.fn();
+const fetchMeMock = vi.fn();
+
+let authState = {
+  user: {
+    access_token: "access-token",
+    profile: {
+      sub: "admin-user",
+      role: "super_admin",
+      name: "Dev Admin",
+    },
+  },
+};
+
+vi.mock("react-oidc-context", () => ({
+  useAuth: () => authState,
+}));
+
+vi.mock("react-router-dom", async () => {
+  const actual =
+    await vi.importActual<typeof import("react-router-dom")>(
+      "react-router-dom",
+    );
+  return {
+    ...actual,
+    useNavigate: () => navigateMock,
+  };
+});
+
+vi.mock("../../lib/devApi", () => ({
+  createClient: vi.fn(),
+  deleteClient: vi.fn(),
+  fetchClient: (...args: unknown[]) => fetchClientMock(...args),
+  fetchClientRelations: (...args: unknown[]) =>
+    fetchClientRelationsMock(...args),
+  fetchMyTenants: (...args: unknown[]) => fetchMyTenantsMock(...args),
+  refreshHeadlessJwksCache: vi.fn(),
+  revokeHeadlessJwksCache: vi.fn(),
+  updateClient: (...args: unknown[]) => updateClientMock(...args),
+  updateClientStatus: vi.fn(),
+}));
+
+vi.mock("../auth/authApi", () => ({
+  fetchMe: (...args: unknown[]) => fetchMeMock(...args),
+}));
+
+vi.mock("../../lib/i18n", () => ({
+  t: (key: string, fallback?: string, vars?: Record<string, unknown>) => {
+    let text = fallback ?? key;
+    for (const [name, value] of Object.entries(vars ?? {})) {
+      text = text.replaceAll(`{{${name}}}`, String(value));
+    }
+    return text;
+  },
+}));
+
+const roots: Root[] = [];
+
+function makeClientDetail(
+  claimKey: string,
+  options?: {
+    includeTenantScope?: boolean;
+    tenantAccessRestricted?: boolean;
+    tenantScopeMandatory?: boolean;
+  },
+): ClientDetailResponse {
+  const includeTenantScope = options?.includeTenantScope ?? false;
+  const tenantAccessRestricted = options?.tenantAccessRestricted ?? false;
+  const tenantScopeMandatory = options?.tenantScopeMandatory ?? false;
+  const structuredScopes = [
+    {
+      id: "1",
+      name: "openid",
+      description: "",
+      mandatory: true,
+    },
+  ];
+
+  if (includeTenantScope) {
+    structuredScopes.push({
+      id: "2",
+      name: "tenant",
+      description: "Tenant access",
+      mandatory: tenantScopeMandatory,
+      locked: tenantAccessRestricted,
+    });
+  }
+
+  return {
+    client: {
+      id: "client-claims",
+      name: "Claims App",
+      type: "private",
+      status: "active",
+      redirectUris: ["https://rp.example.com/callback"],
+      scopes: includeTenantScope
+        ? ["openid", "tenant", "profile"]
+        : ["openid", "profile"],
+      tokenEndpointAuthMethod: "client_secret_basic",
+      metadata: {
+        description: "Claims app",
+        tenant_access_restricted: tenantAccessRestricted,
+        structured_scopes: structuredScopes,
+        id_token_claims: [
+          {
+            namespace: "rp_claims",
+            key: claimKey,
+            value: "A",
+            valueType: "text",
+            readPermission: "admin_only",
+            writePermission: "admin_only",
+          },
+        ],
+      },
+    },
+    endpoints: {
+      discovery: "https://issuer/.well-known/openid-configuration",
+      issuer: "https://issuer",
+      authorization: "https://issuer/oauth2/auth",
+      token: "https://issuer/oauth2/token",
+      userinfo: "https://issuer/userinfo",
+    },
+  };
+}
+
+async function flush() {
+  await act(async () => {
+    await new Promise((resolve) => setTimeout(resolve, 0));
+  });
+}
+
+async function setInputValue(input: HTMLInputElement, value: string) {
+  const descriptor = Object.getOwnPropertyDescriptor(
+    HTMLInputElement.prototype,
+    "value",
+  );
+  descriptor?.set?.call(input, value);
+  input.dispatchEvent(new Event("input", { bubbles: true }));
+  await flush();
+}
+
+async function setTextareaValue(textarea: HTMLTextAreaElement, value: string) {
+  const descriptor = Object.getOwnPropertyDescriptor(
+    HTMLTextAreaElement.prototype,
+    "value",
+  );
+  descriptor?.set?.call(textarea, value);
+  textarea.dispatchEvent(new Event("input", { bubbles: true }));
+  await flush();
+}
+
+async function setSelectValue(select: HTMLSelectElement, value: string) {
+  const descriptor = Object.getOwnPropertyDescriptor(
+    HTMLSelectElement.prototype,
+    "value",
+  );
+  descriptor?.set?.call(select, value);
+  select.dispatchEvent(new Event("change", { bubbles: true }));
+  await flush();
+}
+
+async function renderPage() {
+  const container = document.createElement("div");
+  document.body.appendChild(container);
+  const root = createRoot(container);
+  roots.push(root);
+  const queryClient = new QueryClient({
+    defaultOptions: {
+      queries: { retry: false },
+      mutations: { retry: false },
+    },
+  });
+
+  await act(async () => {
+    root.render(
+      <QueryClientProvider client={queryClient}>
+        <MemoryRouter initialEntries={["/clients/client-claims/settings"]}>
+          <Routes>
+            <Route
+              path="/clients/:id/settings"
+              element={<ClientGeneralPage />}
+            />
+          </Routes>
+        </MemoryRouter>
+      </QueryClientProvider>,
+    );
+  });
+  await flush();
+
+  return { container, queryClient };
+}
+
+describe("ClientGeneralPage RP claims", () => {
+  beforeEach(() => {
+    authState = {
+      user: {
+        access_token: "access-token",
+        profile: {
+          sub: "admin-user",
+          role: "super_admin",
+          name: "Dev Admin",
+        },
+      },
+    };
+    fetchClientMock.mockResolvedValue(makeClientDetail("old_claim"));
+    updateClientMock.mockResolvedValue(makeClientDetail("new_claim"));
+    fetchClientRelationsMock.mockResolvedValue({ items: [] });
+    fetchMyTenantsMock.mockResolvedValue([]);
+    fetchMeMock.mockResolvedValue({
+      id: "admin-user",
+      role: "super_admin",
+      name: "Dev Admin",
+    });
+    navigateMock.mockReset();
+  });
+
+  afterEach(() => {
+    for (const root of roots.splice(0)) {
+      act(() => {
+        root.unmount();
+      });
+    }
+    vi.restoreAllMocks();
+    vi.clearAllMocks();
+    document.body.innerHTML = "";
+  });
+
+  it("updates the client detail cache with saved RP claims before stale data can rehydrate the form", async () => {
+    const { container, queryClient } = await renderPage();
+
+    const claimKeyInput = container.querySelector<HTMLInputElement>(
+      'input[placeholder="e.g. locale"]',
+    );
+    expect(claimKeyInput).not.toBeNull();
+    expect(claimKeyInput?.value).toBe("old_claim");
+
+    await setInputValue(claimKeyInput as HTMLInputElement, "new_claim");
+
+    const saveButton = Array.from(container.querySelectorAll("button")).find(
+      (button) =>
+        button.textContent?.includes("저장") ||
+        button.textContent?.includes("Save"),
+    );
+    expect(saveButton).toBeDefined();
+
+    await act(async () => {
+      saveButton?.dispatchEvent(new MouseEvent("click", { bubbles: true }));
+    });
+    await flush();
+
+    const cached = queryClient.getQueryData<ClientDetailResponse>([
+      "client",
+      "client-claims",
+    ]);
+    expect(cached?.client.metadata?.id_token_claims).toEqual([
+      {
+        namespace: "rp_claims",
+        key: "new_claim",
+        value: "A",
+        valueType: "text",
+        readPermission: "admin_only",
+        writePermission: "admin_only",
+      },
+    ]);
+  });
+
+  it("forces user read permission on when user write permission is enabled for RP claims", async () => {
+    const { container } = await renderPage();
+
+    const switches = Array.from(
+      container.querySelectorAll<HTMLButtonElement>('[role="switch"]'),
+    );
+    const readSwitch = switches.find((button) =>
+      /Read|읽기/.test(button.getAttribute("aria-label") ?? ""),
+    );
+    const writeSwitch = switches.find((button) =>
+      /Write|쓰기/.test(button.getAttribute("aria-label") ?? ""),
+    );
+
+    expect(readSwitch).toBeDefined();
+    expect(writeSwitch).toBeDefined();
+    expect(readSwitch?.getAttribute("aria-checked")).toBe("false");
+    expect(writeSwitch?.getAttribute("aria-checked")).toBe("false");
+
+    await act(async () => {
+      writeSwitch?.dispatchEvent(new MouseEvent("click", { bubbles: true }));
+    });
+    await flush();
+
+    expect(readSwitch?.getAttribute("aria-checked")).toBe("true");
+    expect(writeSwitch?.getAttribute("aria-checked")).toBe("true");
+
+    const saveButton = Array.from(container.querySelectorAll("button")).find(
+      (button) =>
+        button.textContent?.includes("저장") ||
+        button.textContent?.includes("Save"),
+    );
+    expect(saveButton).toBeDefined();
+
+    await act(async () => {
+      saveButton?.dispatchEvent(new MouseEvent("click", { bubbles: true }));
+    });
+    await flush();
+
+    expect(updateClientMock).toHaveBeenCalledWith(
+      "client-claims",
+      expect.objectContaining({
+        metadata: expect.objectContaining({
+          id_token_claims: [
+            expect.objectContaining({
+              readPermission: "user_and_admin",
+              writePermission: "user_and_admin",
+            }),
+          ],
+        }),
+      }),
+    );
+  });
+
+  it("preserves tenant scope mandatory state when tenant access restriction is off", async () => {
+    fetchClientMock.mockResolvedValue(
+      makeClientDetail("old_claim", {
+        includeTenantScope: true,
+        tenantAccessRestricted: false,
+        tenantScopeMandatory: true,
+      }),
+    );
+    updateClientMock.mockResolvedValue(
+      makeClientDetail("old_claim", {
+        includeTenantScope: true,
+        tenantAccessRestricted: false,
+        tenantScopeMandatory: false,
+      }),
+    );
+
+    const { container } = await renderPage();
+
+    const tenantScopeRow = Array.from(container.querySelectorAll("tr")).find(
+      (row) =>
+        Array.from(row.querySelectorAll("input")).some(
+          (input) => (input as HTMLInputElement).value === "tenant",
+        ),
+    );
+
+    expect(tenantScopeRow).toBeDefined();
+    const mandatorySwitch =
+      tenantScopeRow?.querySelector<HTMLButtonElement>('[role="switch"]');
+    expect(mandatorySwitch).toBeDefined();
+    expect(mandatorySwitch?.getAttribute("aria-checked")).toBe("true");
+
+    await act(async () => {
+      mandatorySwitch?.dispatchEvent(
+        new MouseEvent("click", { bubbles: true }),
+      );
+    });
+    await flush();
+
+    expect(mandatorySwitch?.getAttribute("aria-checked")).toBe("false");
+
+    const saveButton = Array.from(container.querySelectorAll("button")).find(
+      (button) =>
+        button.textContent?.includes("저장") ||
+        button.textContent?.includes("Save"),
+    );
+    expect(saveButton).toBeDefined();
+
+    await act(async () => {
+      saveButton?.dispatchEvent(new MouseEvent("click", { bubbles: true }));
+    });
+    await flush();
+
+    expect(updateClientMock).toHaveBeenCalledWith(
+      "client-claims",
+      expect.objectContaining({
+        metadata: expect.objectContaining({
+          tenant_access_restricted: false,
+          structured_scopes: expect.arrayContaining([
+            expect.objectContaining({
+              name: "tenant",
+              mandatory: false,
+              locked: false,
+            }),
+          ]),
+        }),
+      }),
+    );
+  });
+
+  it("keeps nullable and default value as separate RP claim settings", async () => {
+    const { container } = await renderPage();
+
+    expect(container.textContent).toContain("Nullable");
+    expect(container.textContent).toContain("Default Value");
+    expect(container.textContent).not.toContain("Nullable/default");
+    expect(container.textContent).toContain(
+      "RP 전용 확장 claim을 구분해서 관리합니다",
+    );
+  });
+
+  it("shows supported scopes including offline_access and custom claims from the add scope button", async () => {
+    const { container } = await renderPage();
+
+    const addScopeButton = Array.from(
+      container.querySelectorAll("button"),
+    ).find((button) => button.textContent?.includes("Scope 추가"));
+    expect(addScopeButton).toBeDefined();
+
+    await act(async () => {
+      addScopeButton?.dispatchEvent(new MouseEvent("click", { bubbles: true }));
+    });
+    await flush();
+
+    expect(container.textContent).toContain("offline_access");
+    expect(container.textContent).toContain("old_claim");
+
+    const customClaimButton = Array.from(
+      container.querySelectorAll("button"),
+    ).find((button) => button.textContent?.includes("old_claim"));
+    expect(customClaimButton).toBeDefined();
+
+    await act(async () => {
+      customClaimButton?.dispatchEvent(
+        new MouseEvent("click", { bubbles: true }),
+      );
+    });
+    await flush();
+
+    const scopeInputs = Array.from(
+      container.querySelectorAll<HTMLInputElement>(
+        'input[placeholder="e.g. profile"]',
+      ),
+    );
+    expect(scopeInputs.some((input) => input.value === "old_claim")).toBe(true);
+  });
+
+  it("blocks saving a number RP claim default value that is not numeric", async () => {
+    const { container } = await renderPage();
+
+    const valueTypeSelect = container.querySelector<HTMLSelectElement>(
+      'select[aria-label="Claim 값 타입"]',
+    );
+    expect(valueTypeSelect).not.toBeNull();
+    await setSelectValue(valueTypeSelect as HTMLSelectElement, "number");
+
+    const saveButton = Array.from(container.querySelectorAll("button")).find(
+      (button) =>
+        button.textContent?.includes("저장") ||
+        button.textContent?.includes("Save"),
+    );
+    expect(saveButton).toBeDefined();
+
+    await act(async () => {
+      saveButton?.dispatchEvent(new MouseEvent("click", { bubbles: true }));
+    });
+    await flush();
+
+    expect(updateClientMock).not.toHaveBeenCalled();
+  });
+
+  it("blocks saving a number RP claim default value that is not an integer", async () => {
+    const { container } = await renderPage();
+
+    const valueTypeSelect = container.querySelector<HTMLSelectElement>(
+      'select[aria-label="Claim 값 타입"]',
+    );
+    expect(valueTypeSelect).not.toBeNull();
+    await setSelectValue(valueTypeSelect as HTMLSelectElement, "number");
+
+    const defaultValueInput = container.querySelector<HTMLInputElement>(
+      'input[placeholder="Enter the default value"]',
+    );
+    expect(defaultValueInput).not.toBeNull();
+    await setInputValue(defaultValueInput as HTMLInputElement, "3.14");
+
+    expect(container.textContent).toContain(
+      "Claim 기본값이 타입과 맞지 않습니다",
+    );
+
+    const saveButton = Array.from(container.querySelectorAll("button")).find(
+      (button) =>
+        button.textContent?.includes("저장") ||
+        button.textContent?.includes("Save"),
+    );
+    expect(saveButton).toBeDefined();
+
+    await act(async () => {
+      saveButton?.dispatchEvent(new MouseEvent("click", { bubbles: true }));
+    });
+    await flush();
+
+    expect(updateClientMock).not.toHaveBeenCalled();
+  });
+
+  it("saves a float RP claim default value", async () => {
+    const { container } = await renderPage();
+
+    const valueTypeSelect = container.querySelector<HTMLSelectElement>(
+      'select[aria-label="Claim 값 타입"]',
+    );
+    expect(valueTypeSelect).not.toBeNull();
+    expect(
+      valueTypeSelect?.querySelector('option[value="float"]'),
+    ).not.toBeNull();
+    await setSelectValue(valueTypeSelect as HTMLSelectElement, "float");
+
+    const defaultValueInput = container.querySelector<HTMLInputElement>(
+      'input[placeholder="Enter the default value"]',
+    );
+    expect(defaultValueInput).not.toBeNull();
+    expect(defaultValueInput?.getAttribute("inputmode")).toBe("decimal");
+    await setInputValue(defaultValueInput as HTMLInputElement, "3.14");
+
+    const saveButton = Array.from(container.querySelectorAll("button")).find(
+      (button) =>
+        button.textContent?.includes("저장") ||
+        button.textContent?.includes("Save"),
+    );
+    expect(saveButton).toBeDefined();
+
+    await act(async () => {
+      saveButton?.dispatchEvent(new MouseEvent("click", { bubbles: true }));
+    });
+    await flush();
+
+    expect(updateClientMock).toHaveBeenCalledWith(
+      "client-claims",
+      expect.objectContaining({
+        metadata: expect.objectContaining({
+          id_token_claims: [
+            expect.objectContaining({
+              value: "3.14",
+              valueType: "float",
+            }),
+          ],
+        }),
+      }),
+    );
+  });
+
+  it("renders constrained default value controls for boolean and date RP claims", async () => {
+    const { container } = await renderPage();
+
+    const valueTypeSelect = container.querySelector<HTMLSelectElement>(
+      'select[aria-label="Claim 값 타입"]',
+    );
+    expect(valueTypeSelect).not.toBeNull();
+
+    await setSelectValue(valueTypeSelect as HTMLSelectElement, "boolean");
+    const booleanDefaultSelect = Array.from(
+      container.querySelectorAll<HTMLSelectElement>("select"),
+    ).find((select) =>
+      Array.from(select.options).some((option) => option.value === "false"),
+    );
+    expect(booleanDefaultSelect).toBeDefined();
+
+    await setSelectValue(valueTypeSelect as HTMLSelectElement, "date");
+    expect(container.querySelector('input[type="date"]')).not.toBeNull();
+    expect(
+      container.querySelector('select[aria-label="Claim 기본값 시간대"]'),
+    ).not.toBeNull();
+  });
+
+  it("saves date RP claim default values as Unix seconds for the selected timezone", async () => {
+    vi.spyOn(Intl.DateTimeFormat.prototype, "resolvedOptions").mockReturnValue({
+      locale: "ko-KR",
+      calendar: "gregory",
+      numberingSystem: "latn",
+      timeZone: "Asia/Seoul",
+    } as Intl.ResolvedDateTimeFormatOptions);
+    const { container } = await renderPage();
+
+    const valueTypeSelect = container.querySelector<HTMLSelectElement>(
+      'select[aria-label="Claim 값 타입"]',
+    );
+    expect(valueTypeSelect).not.toBeNull();
+    await setSelectValue(valueTypeSelect as HTMLSelectElement, "date");
+
+    const defaultValueInput =
+      container.querySelector<HTMLInputElement>('input[type="date"]');
+    expect(defaultValueInput).not.toBeNull();
+    await setInputValue(defaultValueInput as HTMLInputElement, "2026-06-10");
+
+    const saveButton = Array.from(container.querySelectorAll("button")).find(
+      (button) =>
+        button.textContent?.includes("저장") ||
+        button.textContent?.includes("Save"),
+    );
+    expect(saveButton).toBeDefined();
+
+    await act(async () => {
+      saveButton?.dispatchEvent(new MouseEvent("click", { bubbles: true }));
+    });
+    await flush();
+
+    expect(updateClientMock).toHaveBeenCalledWith(
+      "client-claims",
+      expect.objectContaining({
+        metadata: expect.objectContaining({
+          id_token_claims: [
+            expect.objectContaining({
+              value: 1781017200,
+              valueType: "date",
+            }),
+          ],
+        }),
+      }),
+    );
+  });
+
+  it("blocks saving an object RP claim default value that is not a JSON object", async () => {
+    const { container } = await renderPage();
+
+    const valueTypeSelect = container.querySelector<HTMLSelectElement>(
+      'select[aria-label="Claim 값 타입"]',
+    );
+    expect(valueTypeSelect).not.toBeNull();
+    await setSelectValue(valueTypeSelect as HTMLSelectElement, "object");
+
+    const defaultValueInput = container.querySelector<HTMLTextAreaElement>(
+      'textarea[placeholder="{\\"key\\": \\"value\\"}"]',
+    );
+    expect(defaultValueInput).not.toBeNull();
+    await setTextareaValue(
+      defaultValueInput as HTMLTextAreaElement,
+      "not-json",
+    );
+
+    const saveButton = Array.from(container.querySelectorAll("button")).find(
+      (button) =>
+        button.textContent?.includes("저장") ||
+        button.textContent?.includes("Save"),
+    );
+    expect(saveButton).toBeDefined();
+
+    await act(async () => {
+      saveButton?.dispatchEvent(new MouseEvent("click", { bubbles: true }));
+    });
+    await flush();
+
+    expect(updateClientMock).not.toHaveBeenCalled();
+  });
+});

devfront/src/features/clients/ClientsPage.test.tsx

@@ -167,7 +167,67 @@ async function renderPage() {
   return container;
 }
 
+async function waitForTextContent(container: HTMLElement, text: string) {
+  for (let attempt = 0; attempt < 20; attempt += 1) {
+    if (container.textContent?.includes(text)) {
+      return;
+    }
+
+    await act(async () => {
+      await new Promise((resolve) => setTimeout(resolve, 0));
+    });
+  }
+
+  throw new Error(`Expected container text to include: ${text}`);
+}
+
 describe("ClientsPage", () => {
+  it("does not show the legacy tenant scope label for unrestricted clients", async () => {
+    fetchClientsMock.mockResolvedValue({
+      items: [
+        {
+          ...makeClients(1)[0],
+          name: "Unrestricted App",
+          metadata: {
+            tenant_access_restricted: false,
+            allowed_tenants: [],
+          },
+        },
+      ],
+      limit: 100,
+      offset: 0,
+    });
+
+    const container = await renderPage();
+
+    expect(container.textContent).toContain("Unrestricted App");
+    expect(container.textContent).not.toContain("Tenant-scoped");
+    expect(container.textContent).not.toContain("Tenant-limited");
+  });
+
+  it("shows Tenant-limited only when client tenant access is restricted", async () => {
+    fetchClientsMock.mockResolvedValue({
+      items: [
+        {
+          ...makeClients(1)[0],
+          name: "Limited App",
+          metadata: {
+            tenant_access_restricted: true,
+            allowed_tenants: ["tenant-1"],
+          },
+        },
+      ],
+      limit: 100,
+      offset: 0,
+    });
+
+    const container = await renderPage();
+
+    expect(container.textContent).toContain("Limited App");
+    expect(container.textContent).toContain("Tenant-limited");
+    expect(container.textContent).not.toContain("Tenant-scoped");
+  });
+
   it("expands the list and applies search filters", async () => {
     fetchClientsMock.mockResolvedValue({
       items: makeClients(6),
@@ -277,4 +337,76 @@ describe("ClientsPage", () => {
 
     expect(navigateMock).toHaveBeenCalledWith("/developer-requests");
   });
+
+  it("allows a user without tenant context to request developer access", async () => {
+    authState = {
+      user: {
+        access_token: "access-token",
+        profile: {
+          role: "user",
+          companyCode: "HANMAC",
+          name: "Requester",
+          email: "requester@example.com",
+          phone: "010-1234-5678",
+        },
+      },
+    };
+    fetchMeMock.mockResolvedValue({
+      role: "user",
+      name: "Requester",
+      email: "requester@example.com",
+      phone: "010-1234-5678",
+    });
+    fetchDeveloperRequestStatusMock.mockResolvedValue({ status: "none" });
+
+    const container = await renderPage();
+    await waitForTextContent(container, "개발자 등록 신청하기");
+
+    const requestButton = Array.from(container.querySelectorAll("button")).find(
+      (button) => button.textContent === "개발자 등록 신청하기",
+    );
+    expect(requestButton).toBeTruthy();
+
+    await act(async () => {
+      requestButton?.dispatchEvent(new MouseEvent("click", { bubbles: true }));
+    });
+
+    expect(navigateMock).toHaveBeenCalledWith("/developer-requests");
+    expect(fetchDeveloperRequestStatusMock).toHaveBeenCalled();
+  });
+
+  it("shows the create app button for a super admin without tenant context", async () => {
+    authState = {
+      user: {
+        access_token: "access-token",
+        profile: {
+          role: "super_admin",
+          companyCode: "HANMAC",
+          name: "Dev Admin",
+          email: "dev@example.com",
+          phone: "010-0000-0000",
+        },
+      },
+    };
+    fetchMeMock.mockResolvedValue({
+      role: "super_admin",
+      name: "Dev Admin",
+      email: "dev@example.com",
+      phone: "010-0000-0000",
+    });
+
+    const container = await renderPage();
+    expect(container.textContent).toContain("연동 앱 추가");
+
+    const createButton = Array.from(container.querySelectorAll("button")).find(
+      (button) => button.textContent === "연동 앱 추가",
+    );
+    expect(createButton).toBeTruthy();
+
+    await act(async () => {
+      createButton?.dispatchEvent(new MouseEvent("click", { bubbles: true }));
+    });
+
+    expect(navigateMock).toHaveBeenCalledWith("/clients/new");
+  });
 });

devfront/src/features/clients/ClientsPage.tsx

@@ -59,6 +59,19 @@ import { ClientLogo } from "./components/ClientLogo";
 type ClientSortKey = "application" | "id" | "type" | "status" | "createdAt";
 const clientListPreviewCount = 5;
 
+function isClientTenantLimited(client: ClientSummary) {
+  const metadata = client.metadata ?? {};
+  if (metadata.tenant_access_restricted === true) {
+    return true;
+  }
+  if (!Array.isArray(metadata.allowed_tenants)) {
+    return false;
+  }
+  return metadata.allowed_tenants.some(
+    (tenantId) => typeof tenantId === "string" && tenantId.trim() !== "",
+  );
+}
+
 function ClientsPage() {
   const navigate = useNavigate();
   const auth = useAuth();
@@ -93,9 +106,7 @@ function ClientsPage() {
   } = useQuery({
     queryKey: ["developer-request", tenantId],
     queryFn: () => fetchDeveloperRequestStatus(tenantId),
-    enabled:
-      hasAccessToken &&
-      (profileRole === "user" || profileRole === "tenant_member"),
+    enabled: hasAccessToken && profileRole === "user",
   });
   const { data: tenants } = useQuery({
     queryKey: ["myTenants"],
@@ -105,11 +116,11 @@ function ClientsPage() {
 
   const createAccessState = resolveClientCreateAccess({
     role: profileRole,
-    requestStatus: requestStatus?.status,
+    accessStatus: requestStatus,
   });
   const canCreateClient = createAccessState === "can_create";
-  const isDeveloperRequestPending = createAccessState === "pending";
-  const canRequestDeveloperAccess =
+  const isClientCreatePending = createAccessState === "pending";
+  const canRequestClientCreateAccess =
     createAccessState === "request_required" && !isLoadingRequest;
 
   const [searchQuery, setSearchQuery] = useState("");
@@ -240,7 +251,7 @@ function ClientsPage() {
               <Plus className="h-4 w-4" />
               {t("ui.dev.clients.new", "새 클라이언트")}
             </Button>
-          ) : isDeveloperRequestPending ? (
+          ) : isClientCreatePending ? (
             <div className="flex items-center justify-end gap-3">
               <p className="max-w-xs text-right text-sm text-muted-foreground">
                 {t(
@@ -257,7 +268,7 @@ function ClientsPage() {
                 {t("ui.dev.nav.developer_request", "개발자 권한 신청")}
               </Button>
             </div>
-          ) : canRequestDeveloperAccess ? (
+          ) : canRequestClientCreateAccess ? (
             <div className="flex items-center justify-end gap-3">
               <p className="max-w-xs whitespace-pre-line text-right text-sm text-muted-foreground">
                 {t(
@@ -460,7 +471,7 @@ function ClientsPage() {
                                     "msg.dev.clients.empty_can_create",
                                     "아직 등록된 연동 앱이 없습니다.",
                                   )
-                                : isDeveloperRequestPending
+                                : isClientCreatePending
                                   ? t(
                                       "msg.dev.clients.empty_pending",
                                       "개발자 권한 신청을 검토 중입니다.",
@@ -482,7 +493,7 @@ function ClientsPage() {
                                       "msg.dev.clients.empty_can_create_detail",
                                       "연동 앱 추가 버튼으로 새 RP를 생성하면 이 목록에 표시됩니다.",
                                     )
-                                  : isDeveloperRequestPending
+                                  : isClientCreatePending
                                     ? t(
                                         "msg.dev.clients.empty_pending_detail",
                                         "super admin이 승인하면 연동 앱을 추가할 수 있습니다.",
@@ -501,7 +512,7 @@ function ClientsPage() {
                                 {t("ui.dev.clients.new", "연동 앱 추가")}
                               </button>
                             )}
-                            {!isFilteredOut && canRequestDeveloperAccess && (
+                            {!isFilteredOut && canRequestClientCreateAccess && (
                               <button
                                 type="button"
                                 className="text-primary font-bold hover:underline"
@@ -531,14 +542,16 @@ function ClientsPage() {
                               {client.name ||
                                 t("ui.dev.clients.untitled", "Untitled")}
                             </p>
-                            <p className="text-xs text-muted-foreground">
-                              <span aria-hidden="true">
-                                {t(
-                                  "ui.dev.clients.tenant_scoped",
-                                  "Tenant-scoped",
-                                )}
-                              </span>
-                            </p>
+                            {isClientTenantLimited(client) && (
+                              <p className="text-xs text-muted-foreground">
+                                <span aria-hidden="true">
+                                  {t(
+                                    "ui.dev.clients.tenant_limited",
+                                    "Tenant-limited",
+                                  )}
+                                </span>
+                              </p>
+                            )}
                           </div>
                         </Link>
                       </TableCell>
@@ -695,6 +708,7 @@ function RequestAccessModal({
       organization,
       reason,
       tenantId,
+      accessPages: ["all"],
     });
   };
 

devfront/src/features/clients/clientCreateAccess.test.ts

@@ -5,7 +5,7 @@ describe("client create access", () => {
   it("allows privileged roles to create clients without developer request approval", () => {
     expect(
       resolveClientCreateAccess({
-        role: "rp_admin",
+        role: "super_admin",
       }),
     ).toBe("can_create");
   });
@@ -14,7 +14,7 @@ describe("client create access", () => {
     expect(
       resolveClientCreateAccess({
         role: "user",
-        requestStatus: "none",
+        accessStatus: { status: "none" },
       }),
     ).toBe("request_required");
   });
@@ -23,7 +23,7 @@ describe("client create access", () => {
     expect(
       resolveClientCreateAccess({
         role: "",
-        requestStatus: undefined,
+        accessStatus: undefined,
       }),
     ).toBe("request_required");
   });
@@ -31,8 +31,8 @@ describe("client create access", () => {
   it("shows pending state while a developer request is under review", () => {
     expect(
       resolveClientCreateAccess({
-        role: "tenant_member",
-        requestStatus: "pending",
+        role: "user",
+        accessStatus: { status: "pending", pendingPages: ["client_create"] },
       }),
     ).toBe("pending");
   });
@@ -41,7 +41,10 @@ describe("client create access", () => {
     expect(
       resolveClientCreateAccess({
         role: "user",
-        requestStatus: "approved",
+        accessStatus: {
+          status: "approved",
+          approvedPages: ["client_create"],
+        },
       }),
     ).toBe("can_create");
   });
@@ -50,14 +53,14 @@ describe("client create access", () => {
     expect(
       resolveClientCreateAccess({
         role: "user",
-        requestStatus: "cancelled",
+        accessStatus: { status: "cancelled" },
       }),
     ).toBe("request_required");
 
     expect(
       resolveClientCreateAccess({
         role: "user",
-        requestStatus: "rejected",
+        accessStatus: { status: "rejected" },
       }),
     ).toBe("request_required");
   });

devfront/src/features/clients/clientCreateAccess.ts

@@ -1,4 +1,8 @@
-import type { DeveloperRequestStatus } from "../../lib/devApi";
+import type { DeveloperAccessStatus } from "../../lib/devApi";
+import {
+  hasDeveloperAccessForPages,
+  isDeveloperRequestPendingForPages,
+} from "../developer-access/developerAccessPages";
 
 export type ClientCreateAccessState =
   | "can_create"
@@ -8,16 +12,16 @@ export type ClientCreateAccessState =
 
 type ResolveClientCreateAccessParams = {
   role: string;
-  requestStatus?: DeveloperRequestStatus;
+  accessStatus?: DeveloperAccessStatus;
 };
 
 function canSelfRequestDeveloperAccess(role: string) {
-  return role === "user" || role === "tenant_member";
+  return role === "user";
 }
 
 export function resolveClientCreateAccess({
   role,
-  requestStatus,
+  accessStatus,
 }: ResolveClientCreateAccessParams): ClientCreateAccessState {
   if (!role.trim()) {
     return "request_required";
@@ -27,22 +31,19 @@ export function resolveClientCreateAccess({
     return "can_create";
   }
 
-  if (requestStatus === "approved") {
+  if (
+    hasDeveloperAccessForPages(accessStatus?.approvedPages, ["client_create"])
+  ) {
     return "can_create";
   }
 
-  if (requestStatus === "pending") {
+  if (
+    isDeveloperRequestPendingForPages(accessStatus?.pendingPages, [
+      "client_create",
+    ])
+  ) {
     return "pending";
   }
 
-  if (
-    requestStatus === "none" ||
-    requestStatus === "rejected" ||
-    requestStatus === "cancelled" ||
-    typeof requestStatus === "undefined"
-  ) {
-    return "request_required";
-  }
-
-  return "forbidden";
+  return "request_required";
 }

devfront/src/features/clients/rpClaimDateTime.test.ts

@@ -0,0 +1,32 @@
+import { describe, expect, it } from "vitest";
+import {
+  claimDateTimeValueToInputString,
+  dateTimeInputToUnixSeconds,
+  unixSecondsToDateTimeInput,
+} from "./rpClaimDateTime";
+
+describe("rpClaimDateTime", () => {
+  it("converts date and datetime input in a selected timezone to Unix seconds", () => {
+    expect(dateTimeInputToUnixSeconds("2026-06-10", "date", "Asia/Seoul")).toBe(
+      1781017200,
+    );
+    expect(
+      dateTimeInputToUnixSeconds("2026-06-09T10:30", "datetime", "Asia/Seoul"),
+    ).toBe(1780968600);
+  });
+
+  it("formats stored Unix seconds for the selected timezone", () => {
+    expect(unixSecondsToDateTimeInput(1781017200, "date", "Asia/Seoul")).toBe(
+      "2026-06-10",
+    );
+    expect(
+      unixSecondsToDateTimeInput(1780968600, "datetime", "Asia/Seoul"),
+    ).toBe("2026-06-09T10:30");
+  });
+
+  it("uses Unix seconds values when hydrating date inputs", () => {
+    expect(
+      claimDateTimeValueToInputString(1780968600, "", "datetime", "Asia/Seoul"),
+    ).toBe("2026-06-09T10:30");
+  });
+});

devfront/src/features/clients/rpClaimDateTime.ts

@@ -0,0 +1,137 @@
+export type RPClaimDateTimeValueType = "date" | "datetime";
+
+export const FALLBACK_TIME_ZONE = "UTC";
+
+export function getBrowserTimeZone(): string {
+  return Intl.DateTimeFormat().resolvedOptions().timeZone || FALLBACK_TIME_ZONE;
+}
+
+export function getSupportedTimeZones(currentTimeZone = getBrowserTimeZone()) {
+  const supported =
+    typeof Intl.supportedValuesOf === "function"
+      ? Intl.supportedValuesOf("timeZone")
+      : [];
+  return Array.from(
+    new Set([currentTimeZone, FALLBACK_TIME_ZONE, ...supported]),
+  );
+}
+
+function getTimeZoneOffsetMs(date: Date, timeZone: string) {
+  const parts = new Intl.DateTimeFormat("en-US", {
+    timeZone,
+    hour12: false,
+    year: "numeric",
+    month: "2-digit",
+    day: "2-digit",
+    hour: "2-digit",
+    minute: "2-digit",
+    second: "2-digit",
+  }).formatToParts(date);
+  const values = Object.fromEntries(
+    parts
+      .filter((part) => part.type !== "literal")
+      .map((part) => [part.type, part.value]),
+  );
+  const hour = values.hour === "24" ? "00" : values.hour;
+  const asUTC = Date.UTC(
+    Number(values.year),
+    Number(values.month) - 1,
+    Number(values.day),
+    Number(hour),
+    Number(values.minute),
+    Number(values.second),
+  );
+  return asUTC - date.getTime();
+}
+
+function zonedDateTimeToUnixSeconds(
+  year: number,
+  month: number,
+  day: number,
+  hour: number,
+  minute: number,
+  timeZone: string,
+) {
+  const utcGuess = Date.UTC(year, month - 1, day, hour, minute, 0);
+  let instant = utcGuess - getTimeZoneOffsetMs(new Date(utcGuess), timeZone);
+  const corrected = utcGuess - getTimeZoneOffsetMs(new Date(instant), timeZone);
+  if (corrected !== instant) {
+    instant = corrected;
+  }
+  return Math.trunc(instant / 1000);
+}
+
+export function dateTimeInputToUnixSeconds(
+  value: string,
+  valueType: RPClaimDateTimeValueType,
+  timeZone: string,
+): number | null {
+  const trimmed = value.trim();
+  const match =
+    valueType === "date"
+      ? /^(\d{4})-(\d{2})-(\d{2})$/.exec(trimmed)
+      : /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2})$/.exec(trimmed);
+  if (!match) return null;
+
+  const year = Number(match[1]);
+  const month = Number(match[2]);
+  const day = Number(match[3]);
+  const hour = valueType === "datetime" ? Number(match[4]) : 0;
+  const minute = valueType === "datetime" ? Number(match[5]) : 0;
+  const unixSeconds = zonedDateTimeToUnixSeconds(
+    year,
+    month,
+    day,
+    hour,
+    minute,
+    timeZone || FALLBACK_TIME_ZONE,
+  );
+  return Number.isFinite(unixSeconds) ? unixSeconds : null;
+}
+
+export function unixSecondsToDateTimeInput(
+  value: number,
+  valueType: RPClaimDateTimeValueType,
+  timeZone: string,
+) {
+  const date = new Date(value * 1000);
+  if (Number.isNaN(date.getTime())) return "";
+  const parts = new Intl.DateTimeFormat("en-CA", {
+    timeZone: timeZone || FALLBACK_TIME_ZONE,
+    hour12: false,
+    year: "numeric",
+    month: "2-digit",
+    day: "2-digit",
+    hour: "2-digit",
+    minute: "2-digit",
+  }).formatToParts(date);
+  const values = Object.fromEntries(
+    parts
+      .filter((part) => part.type !== "literal")
+      .map((part) => [part.type, part.value]),
+  );
+  const hour = values.hour === "24" ? "00" : values.hour;
+  const dateText = `${values.year}-${values.month}-${values.day}`;
+  if (valueType === "date") return dateText;
+  return `${dateText}T${hour}:${values.minute}`;
+}
+
+export function claimDateTimeValueToInputString(
+  value: unknown,
+  fallback: string,
+  valueType: RPClaimDateTimeValueType,
+  timeZone: string,
+) {
+  if (typeof value === "number" && Number.isFinite(value)) {
+    return unixSecondsToDateTimeInput(value, valueType, timeZone);
+  }
+  if (typeof value === "string" && /^-?\d+$/.test(value.trim())) {
+    return unixSecondsToDateTimeInput(
+      Number(value.trim()),
+      valueType,
+      timeZone,
+    );
+  }
+  const text = typeof value === "string" ? value : fallback;
+  return valueType === "date" ? text.slice(0, 10) : text.slice(0, 16);
+}

devfront/src/features/coverage/pageSmoke.test.tsx

@@ -11,12 +11,16 @@ import ClientRelationsPage from "../clients/ClientRelationsPage";
 import ClientsPage from "../clients/ClientsPage";
 import { ClientFederationPage } from "../clients/routes/ClientFederationPage";
 import DeveloperRequestPage from "../developer-request/DeveloperRequestPage";
+import DeveloperGrantsPage from "../developer-grants/DeveloperGrantsPage";
 import GlobalOverviewPage from "../overview/GlobalOverviewPage";
 import ProfilePage from "../profile/ProfilePage";
 import {
   approveDeveloperRequest,
   cancelDeveloperRequestApproval,
+  createDeveloperGrant,
+  fetchDeveloperGrants,
   rejectDeveloperRequest,
+  revokeDeveloperGrant,
 } from "../../lib/devApi";
 
 const authProfile = {
@@ -195,6 +199,29 @@ vi.mock("../../lib/devApi", () => ({
       },
     ],
   })),
+  fetchDevUser: vi.fn(async () => ({
+    id: "user-2",
+    email: "editor@example.com",
+    name: "Editor User",
+    phone: "010-1111-2222",
+    role: "user",
+    status: "active",
+    tenant: {
+      id: "tenant-1",
+      name: "Hanmac",
+      slug: "hanmac",
+      type: "COMPANY",
+      status: "active",
+      description: "",
+      memberCount: 10,
+      createdAt: "2026-05-01T00:00:00Z",
+      updatedAt: "2026-05-01T00:00:00Z",
+    },
+    tenantSlug: "hanmac",
+    companyCode: "HANMAC",
+    createdAt: "2026-05-01T00:00:00Z",
+    updatedAt: "2026-05-01T00:00:00Z",
+  })),
   addClientRelation: vi.fn(async () => ({
     relation: "admins",
     subject: "User:user-2",
@@ -290,6 +317,24 @@ vi.mock("../../lib/devApi", () => ({
       updatedAt: "2026-05-01T00:00:00Z",
     },
   ]),
+  fetchTenants: vi.fn(async () => ({
+    items: [
+      {
+        id: "tenant-1",
+        name: "Hanmac",
+        slug: "hanmac",
+        type: "COMPANY",
+        status: "active",
+        description: "",
+        memberCount: 10,
+        createdAt: "2026-05-01T00:00:00Z",
+        updatedAt: "2026-05-01T00:00:00Z",
+      },
+    ],
+    limit: 1000,
+    offset: 0,
+    total: 1,
+  })),
   fetchDeveloperRequestStatus: vi.fn(async () => ({ status: "approved" })),
   requestDeveloperAccess: vi.fn(async () => ({ status: "pending" })),
   fetchDeveloperRequests: vi.fn(async () => [
@@ -319,9 +364,26 @@ vi.mock("../../lib/devApi", () => ({
       updatedAt: "2026-05-02T00:00:00Z",
     },
   ]),
+  fetchDeveloperGrants: vi.fn(async () => [
+    {
+      id: 3,
+      userId: "user-5",
+      tenantId: "tenant-1",
+      name: "Granted User",
+      organization: "Hanmac",
+      email: "granted@example.com",
+      reason: "Direct grant",
+      status: "approved",
+      adminNotes: "Manual grant",
+      createdAt: "2026-05-03T00:00:00Z",
+      updatedAt: "2026-05-03T00:00:00Z",
+    },
+  ]),
   approveDeveloperRequest: vi.fn(async () => ({ status: "approved" })),
   rejectDeveloperRequest: vi.fn(async () => ({ status: "rejected" })),
   cancelDeveloperRequestApproval: vi.fn(async () => ({ status: "cancelled" })),
+  createDeveloperGrant: vi.fn(async () => ({ status: "approved" })),
+  revokeDeveloperGrant: vi.fn(async () => ({ status: "ok" })),
 }));
 
 vi.mock("../auth/authApi", () => ({
@@ -408,6 +470,9 @@ describe("devfront coverage smoke pages", () => {
     const requests = await renderPage(<DeveloperRequestPage />);
     expect(requests.textContent).toContain("Requester");
 
+    const grants = await renderPage(<DeveloperGrantsPage />);
+    expect(grants.textContent).toContain("개발자 권한 부여");
+
     const profile = await renderPage(<ProfilePage />);
     expect(profile.textContent).toContain("Dev Admin");
   });
@@ -427,7 +492,8 @@ describe("devfront coverage smoke pages", () => {
     expect(settings.textContent).not.toContain("top-level");
     expect(settings.textContent).toContain("Date");
     expect(settings.textContent).toContain("Datetime");
-    expect(settings.textContent).toContain("관리자만 가능");
+    expect(settings.textContent).toContain("User read");
+    expect(settings.textContent).toContain("User write");
 
     const consents = await renderPage(<ClientConsentsPage />, {
       path: "/clients/:id/consents",

devfront/src/features/developer-access/developerAccessGate.test.ts

@@ -8,30 +8,63 @@ import {
 describe("developer access gate", () => {
   it("fetches request status only for user roles", () => {
     expect(shouldFetchDeveloperRequestStatus("user")).toBe(true);
-    expect(shouldFetchDeveloperRequestStatus("tenant_admin")).toBe(false);
-    expect(shouldFetchDeveloperRequestStatus("rp_admin")).toBe(false);
+    expect(shouldFetchDeveloperRequestStatus("super_admin")).toBe(false);
   });
 
   it("resolves access and request states from the request status", () => {
-    expect(resolveDeveloperAccessGate("super_admin", "pending")).toEqual({
+    expect(
+      resolveDeveloperAccessGate("super_admin", {
+        status: "pending",
+        pendingPages: ["overview"],
+      }),
+    ).toEqual({
       hasDeveloperAccess: true,
       isDeveloperRequestPending: true,
       canRequestDeveloperAccess: false,
     });
 
-    expect(resolveDeveloperAccessGate("user", "approved")).toEqual({
+    expect(
+      resolveDeveloperAccessGate("user", {
+        status: "approved",
+        approvedPages: ["overview"],
+      }),
+    ).toEqual({
       hasDeveloperAccess: true,
       isDeveloperRequestPending: false,
       canRequestDeveloperAccess: false,
     });
 
-    expect(resolveDeveloperAccessGate("user", "pending")).toEqual({
+    expect(
+      resolveDeveloperAccessGate(
+        "user",
+        {
+          status: "pending",
+          pendingPages: ["audit"],
+        },
+        ["audit"],
+      ),
+    ).toEqual({
       hasDeveloperAccess: false,
       isDeveloperRequestPending: true,
       canRequestDeveloperAccess: false,
     });
 
-    expect(resolveDeveloperAccessGate("user", "none")).toEqual({
+    expect(
+      resolveDeveloperAccessGate(
+        "user",
+        {
+          status: "approved",
+          approvedPages: ["overview"],
+        },
+        ["audit"],
+      ),
+    ).toEqual({
+      hasDeveloperAccess: false,
+      isDeveloperRequestPending: false,
+      canRequestDeveloperAccess: true,
+    });
+
+    expect(resolveDeveloperAccessGate("user", { status: "none" })).toEqual({
       hasDeveloperAccess: false,
       isDeveloperRequestPending: false,
       canRequestDeveloperAccess: true,
@@ -41,7 +74,7 @@ describe("developer access gate", () => {
   it("shows the loading gate only for user requests", () => {
     expect(shouldShowDeveloperAccessLoading("user", true, false)).toBe(true);
     expect(shouldShowDeveloperAccessLoading("user", false, true)).toBe(true);
-    expect(shouldShowDeveloperAccessLoading("tenant_admin", true, true)).toBe(
+    expect(shouldShowDeveloperAccessLoading("super_admin", true, true)).toBe(
       false,
     );
   });

devfront/src/features/developer-access/developerAccessGate.ts

@@ -1,31 +1,37 @@
 import { useQuery } from "@tanstack/react-query";
 import {
-  type DeveloperRequestStatus,
+  type DeveloperAccessStatus,
   fetchDeveloperRequestStatus,
 } from "../../lib/devApi";
+import {
+  type DeveloperAccessPage,
+  hasDeveloperAccessForPages,
+  isDeveloperRequestPendingForPages,
+} from "./developerAccessPages";
 
 export type DeveloperAccessGateState = {
   hasDeveloperAccess: boolean;
   isDeveloperRequestPending: boolean;
   canRequestDeveloperAccess: boolean;
   isLoadingDeveloperAccessGate: boolean;
+  isTenantContextMissing: boolean;
 };
 
-function isPrivilegedDeveloperRole(profileRole: string) {
-  return (
-    profileRole === "super_admin" ||
-    profileRole === "rp_admin" ||
-    profileRole === "tenant_admin"
-  );
-}
-
 export function resolveDeveloperAccessGate(
   profileRole: string,
-  requestStatus?: DeveloperRequestStatus,
-): Omit<DeveloperAccessGateState, "isLoadingDeveloperAccessGate"> {
+  accessStatus?: DeveloperAccessStatus,
+  requiredPages: DeveloperAccessPage[] = ["overview"],
+): Omit<
+  DeveloperAccessGateState,
+  "isLoadingDeveloperAccessGate" | "isTenantContextMissing"
+> {
   const hasDeveloperAccess =
-    isPrivilegedDeveloperRole(profileRole) || requestStatus === "approved";
-  const isDeveloperRequestPending = requestStatus === "pending";
+    profileRole === "super_admin" ||
+    hasDeveloperAccessForPages(accessStatus?.approvedPages, requiredPages);
+  const isDeveloperRequestPending = isDeveloperRequestPendingForPages(
+    accessStatus?.pendingPages,
+    requiredPages,
+  );
   const canRequestDeveloperAccess =
     profileRole === "user" && !hasDeveloperAccess && !isDeveloperRequestPending;
 
@@ -54,15 +60,18 @@ export function useDeveloperAccessGate({
   hasAccessToken,
   profileRole,
   tenantId,
+  requiredPages = ["overview"],
   isLoadingIdentity = false,
 }: {
   hasAccessToken: boolean;
   profileRole: string;
   tenantId?: string;
+  requiredPages?: DeveloperAccessPage[];
   isLoadingIdentity?: boolean;
 }) {
   const shouldFetchRequestStatus =
     shouldFetchDeveloperRequestStatus(profileRole);
+  const isTenantContextMissing = !tenantId?.trim();
   const { data: requestStatus, isLoading: isLoadingRequestStatus } = useQuery({
     queryKey: ["developer-request", tenantId],
     queryFn: () => fetchDeveloperRequestStatus(tenantId),
@@ -71,11 +80,14 @@ export function useDeveloperAccessGate({
 
   const resolvedGate = resolveDeveloperAccessGate(
     profileRole,
-    requestStatus?.status,
+    requestStatus,
+    requiredPages,
   );
 
   return {
     ...resolvedGate,
+    isTenantContextMissing,
+    canRequestDeveloperAccess: resolvedGate.canRequestDeveloperAccess,
     isLoadingDeveloperAccessGate: shouldShowDeveloperAccessLoading(
       profileRole,
       isLoadingIdentity,

devfront/src/features/developer-access/developerAccessPages.test.ts

@@ -0,0 +1,24 @@
+import { describe, expect, it } from "vitest";
+import { normalizeDeveloperAccessPageSelection } from "./developerAccessPages";
+
+describe("developer access pages", () => {
+  it("collapses all non-all pages into all", () => {
+    expect(
+      normalizeDeveloperAccessPageSelection([
+        "overview",
+        "client_create",
+        "audit",
+      ]),
+    ).toEqual(["all"]);
+  });
+
+  it("keeps partial selections as-is", () => {
+    expect(
+      normalizeDeveloperAccessPageSelection(["overview", "audit"]),
+    ).toEqual(["overview", "audit"]);
+  });
+
+  it("keeps explicit all selection", () => {
+    expect(normalizeDeveloperAccessPageSelection(["all"])).toEqual(["all"]);
+  });
+});

devfront/src/features/developer-access/developerAccessPages.ts

@@ -0,0 +1,102 @@
+export type DeveloperAccessPage =
+  | "all"
+  | "overview"
+  | "client_create"
+  | "audit";
+
+export const developerAccessPageOrder: DeveloperAccessPage[] = [
+  "overview",
+  "client_create",
+  "audit",
+];
+
+export const developerAccessPageOptions: Array<{
+  value: DeveloperAccessPage;
+  label: string;
+}> = [
+  { value: "all", label: "전체" },
+  { value: "overview", label: "개요" },
+  { value: "client_create", label: "연동 앱 추가" },
+  { value: "audit", label: "감사로그" },
+];
+
+export function normalizeDeveloperAccessPages(
+  pages: Array<string | undefined | null>,
+): DeveloperAccessPage[] {
+  const normalized = new Set<DeveloperAccessPage>();
+  for (const raw of pages) {
+    const page = String(raw ?? "")
+      .trim()
+      .toLowerCase();
+    if (!page) {
+      continue;
+    }
+    if (page === "all") {
+      return ["all"];
+    }
+    if (page === "overview" || page === "client_create" || page === "audit") {
+      normalized.add(page);
+    }
+  }
+
+  return [...developerAccessPageOrder.filter((page) => normalized.has(page))];
+}
+
+export function normalizeDeveloperAccessPageSelection(
+  pages: DeveloperAccessPage[],
+): DeveloperAccessPage[] {
+  if (pages.includes("all")) {
+    return ["all"];
+  }
+  const normalized = normalizeDeveloperAccessPages(pages);
+  if (normalized.length === 0) {
+    return ["all"];
+  }
+  if (normalized.length === developerAccessPageOrder.length) {
+    return ["all"];
+  }
+  return normalized;
+}
+
+export function developerAccessPagesToLabel(pages?: Array<string | null>) {
+  const normalized = normalizeDeveloperAccessPages(pages ?? []);
+  if (normalized.length === 0 || normalized.includes("all")) {
+    return "전체";
+  }
+  return normalized
+    .map((page) => {
+      switch (page) {
+        case "overview":
+          return "개요";
+        case "client_create":
+          return "연동 앱 추가";
+        case "audit":
+          return "감사로그";
+        default:
+          return page;
+      }
+    })
+    .join(", ");
+}
+
+export function hasDeveloperAccessForPages(
+  grantedPages: Array<string | null> | undefined,
+  requiredPages: DeveloperAccessPage[],
+) {
+  const normalized = normalizeDeveloperAccessPages(grantedPages ?? []);
+  if (normalized.includes("all")) {
+    return true;
+  }
+  return requiredPages.some((page) => normalized.includes(page));
+}
+
+export function isDeveloperRequestPendingForPages(
+  pendingPages: Array<string | null> | undefined,
+  requiredPages: DeveloperAccessPage[],
+) {
+  const normalized = normalizeDeveloperAccessPages(pendingPages ?? []);
+  if (normalized.includes("all")) {
+    return true;
+  }
+  return requiredPages.some((page) => normalized.includes(page));
+}

devfront/src/features/developer-grants/DeveloperGrantsPage.tsx

@@ -0,0 +1,681 @@
+import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
+import type { AxiosError } from "axios";
+import { KeyRound, Plus, Search, ShieldCheck, X } from "lucide-react";
+import { useDeferredValue, useMemo, useState } from "react";
+import { useAuth } from "react-oidc-context";
+import { PageHeader } from "../../../../common/core/components/page";
+import { Badge } from "../../components/ui/badge";
+import { Button } from "../../components/ui/button";
+import {
+  Card,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+} from "../../components/ui/card";
+import { Input } from "../../components/ui/input";
+import { Label } from "../../components/ui/label";
+import {
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
+} from "../../components/ui/table";
+import { Textarea } from "../../components/ui/textarea";
+import { toast } from "../../components/ui/use-toast";
+import {
+  createDeveloperGrant,
+  type DevAssignableUser,
+  fetchDeveloperGrants,
+  fetchDevUser,
+  fetchDevUsers,
+  revokeDeveloperGrant,
+} from "../../lib/devApi";
+import { t } from "../../lib/i18n";
+import { resolveProfileRole } from "../../lib/role";
+import { fetchMe } from "../auth/authApi";
+import {
+  type DeveloperAccessPage,
+  developerAccessPageOptions,
+  normalizeDeveloperAccessPageSelection,
+  normalizeDeveloperAccessPages,
+} from "../developer-access/developerAccessPages";
+
+function formatUserLabel(user: DevAssignableUser) {
+  const primary = user.name.trim() || user.email.trim();
+  return `${primary} (${user.email.trim()})`;
+}
+
+export default function DeveloperGrantsPage() {
+  const auth = useAuth();
+  const queryClient = useQueryClient();
+  const hasAccessToken = Boolean(auth.user?.access_token);
+  const userProfile = auth.user?.profile as Record<string, unknown> | undefined;
+  const role = resolveProfileRole(userProfile);
+
+  const { data: me, isLoading: isLoadingMe } = useQuery({
+    queryKey: ["userMe"],
+    queryFn: fetchMe,
+    enabled: hasAccessToken,
+  });
+  const profileRole = me?.role?.trim() || role;
+  const isSuperAdmin = profileRole === "super_admin";
+
+  const [userSearch, setUserSearch] = useState("");
+  const deferredUserSearch = useDeferredValue(userSearch.trim());
+  const [selectedUser, setSelectedUser] = useState<DevAssignableUser | null>(
+    null,
+  );
+  const [selectedAccessPages, setSelectedAccessPages] = useState<
+    DeveloperAccessPage[]
+  >(["all"]);
+  const [grantNotes, setGrantNotes] = useState("");
+  const [adminNotes, setAdminNotes] = useState<Record<number, string>>({});
+
+  const { data: userSearchData, isFetching: isUserSearchLoading } = useQuery({
+    queryKey: ["developer-grant-users", deferredUserSearch],
+    queryFn: () => fetchDevUsers(deferredUserSearch, 10),
+    enabled:
+      hasAccessToken &&
+      isSuperAdmin &&
+      deferredUserSearch.length > 0 &&
+      selectedUser == null,
+  });
+
+  const { data: selectedUserDetail, isFetching: isSelectedUserDetailLoading } =
+    useQuery({
+      queryKey: ["developer-grant-user", selectedUser?.id],
+      queryFn: () => fetchDevUser(selectedUser?.id || ""),
+      enabled: hasAccessToken && isSuperAdmin && selectedUser != null,
+    });
+
+  const {
+    data: grants,
+    isLoading: isLoadingGrants,
+    error: grantsError,
+  } = useQuery({
+    queryKey: ["developer-grants"],
+    queryFn: () => fetchDeveloperGrants(),
+    enabled: hasAccessToken && isSuperAdmin,
+  });
+
+  const grantList = grants ?? [];
+
+  const filteredGrantedUsers = useMemo(() => {
+    return [...grantList].sort((a, b) => {
+      const tenantCompare = a.organization.localeCompare(b.organization);
+      if (tenantCompare !== 0) {
+        return tenantCompare;
+      }
+      return a.name.localeCompare(b.name);
+    });
+  }, [grantList]);
+
+  const createGrantMutation = useMutation({
+    mutationFn: createDeveloperGrant,
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ["developer-grants"] });
+      toast(
+        t(
+          "msg.dev.grants.create_success",
+          "개발자 권한이 직접 부여되었습니다.",
+        ),
+        "success",
+      );
+      setSelectedUser(null);
+      setUserSearch("");
+      setSelectedAccessPages(["all"]);
+      setGrantNotes("");
+    },
+    onError: (err: AxiosError<{ error?: string }> | Error) => {
+      toast(
+        (err as AxiosError<{ error?: string }>).response?.data?.error ||
+          (err as Error).message ||
+          t("msg.common.error", "오류가 발생했습니다."),
+        "error",
+      );
+    },
+  });
+
+  const revokeGrantMutation = useMutation({
+    mutationFn: ({ id, adminNotes }: { id: number; adminNotes: string }) =>
+      revokeDeveloperGrant(id, adminNotes),
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ["developer-grants"] });
+      toast(
+        t("msg.dev.grants.revoke_success", "개발자 권한이 회수되었습니다."),
+        "success",
+      );
+    },
+    onError: (err: AxiosError<{ error?: string }> | Error) => {
+      toast(
+        (err as AxiosError<{ error?: string }>).response?.data?.error ||
+          (err as Error).message ||
+          t("msg.common.error", "오류가 발생했습니다."),
+        "error",
+      );
+    },
+  });
+
+  if (isLoadingMe) {
+    return (
+      <div className="p-8 text-center">
+        {t("ui.common.loading", "Loading...")}
+      </div>
+    );
+  }
+
+  if (!isSuperAdmin) {
+    return (
+      <div className="space-y-6">
+        <PageHeader
+          icon={<ShieldCheck size={20} />}
+          title={t("ui.dev.nav.developer_grants", "개발자 권한 부여")}
+          description={t(
+            "msg.dev.grants.forbidden_desc",
+            "이 화면은 super admin만 사용할 수 있습니다.",
+          )}
+        />
+        <Card className="border-amber-500/30 bg-amber-500/10">
+          <CardContent className="p-4 text-sm text-foreground">
+            {t(
+              "msg.dev.grants.forbidden",
+              "개발자 권한 직접 부여는 super admin만 사용할 수 있습니다.",
+            )}
+          </CardContent>
+        </Card>
+      </div>
+    );
+  }
+
+  const handleGrant = () => {
+    if (!selectedUser) {
+      toast(
+        t("msg.dev.grants.user_required", "부여할 사용자를 선택해주세요."),
+        "error",
+      );
+      return;
+    }
+    const tenantId =
+      selectedUserDetail?.tenant?.id?.trim() ||
+      selectedUserDetail?.tenantSlug?.trim() ||
+      selectedUserDetail?.companyCode?.trim() ||
+      "";
+
+    createGrantMutation.mutate({
+      userId: selectedUser.id,
+      tenantId,
+      reason: grantNotes.trim() || "직접 부여",
+      adminNotes: grantNotes.trim(),
+      accessPages: normalizeDeveloperAccessPageSelection(selectedAccessPages),
+    });
+  };
+
+  const handleSelectUser = (user: DevAssignableUser) => {
+    setSelectedUser(user);
+    setUserSearch(formatUserLabel(user));
+    setSelectedAccessPages(["all"]);
+  };
+
+  const handleAccessPageToggle = (page: DeveloperAccessPage) => {
+    setSelectedAccessPages((current) => {
+      if (page === "all") {
+        return ["all"];
+      }
+      const withoutAll = current.filter((item) => item !== "all");
+      if (withoutAll.includes(page)) {
+        const next = withoutAll.filter((item) => item !== page);
+        return next.length > 0 ? next : ["all"];
+      }
+      return normalizeDeveloperAccessPageSelection([...withoutAll, page]);
+    });
+  };
+
+  return (
+    <div className="space-y-8">
+      <PageHeader
+        icon={<KeyRound size={20} />}
+        title={t("ui.dev.nav.developer_grants", "개발자 권한 부여")}
+        description={t(
+          "msg.dev.grants.description",
+          "사용자에게 개발자 권한을 직접 부여하고, 부여된 권한을 회수할 수 있습니다.",
+        )}
+        actions={
+          <Badge variant="muted">
+            {t("msg.dev.grants.count", "총 {{count}}건", {
+              count: filteredGrantedUsers.length,
+            })}
+          </Badge>
+        }
+      />
+
+      <Card className="glass-panel">
+        <CardHeader>
+          <CardTitle className="text-xl">
+            {t("ui.dev.grants.form.title", "직접 부여")}
+          </CardTitle>
+          <CardDescription>
+            {t(
+              "msg.dev.grants.form.description",
+              "사용자를 선택하면 현재 소속 정보가 표시되고, 그 사용자에게 개발자 권한을 즉시 부여합니다.",
+            )}
+          </CardDescription>
+        </CardHeader>
+        <CardContent className="space-y-5">
+          <div className="grid gap-4 xl:grid-cols-[minmax(0,1.15fr)_minmax(0,0.85fr)]">
+            <Card className="border-primary/10 bg-primary/5 shadow-sm">
+              <CardHeader className="space-y-1 pb-3">
+                <div className="flex items-center justify-between gap-2">
+                  <CardTitle className="text-base">
+                    {t("ui.dev.grants.user_section", "사용자 선택")}
+                  </CardTitle>
+                  <Badge variant="outline">
+                    {t("ui.dev.grants.input_section", "입력")}
+                  </Badge>
+                </div>
+                <CardDescription>
+                  {t(
+                    "msg.dev.grants.user_section_description",
+                    "검색어를 입력해 사용자를 선택합니다. 선택 전에는 다음 단계 정보가 비어 있습니다.",
+                  )}
+                </CardDescription>
+              </CardHeader>
+              <CardContent className="space-y-2 pt-0">
+                <div className="space-y-2">
+                  <Label htmlFor="user-search">
+                    {t("ui.dev.grants.user", "사용자")}{" "}
+                    <span className="text-destructive">*</span>
+                  </Label>
+                  <div className="relative">
+                    <Search className="absolute left-3 top-1/2 h-4 w-4 -translate-y-1/2 text-muted-foreground" />
+                    <Input
+                      id="user-search"
+                      className="pl-10"
+                      placeholder={t(
+                        "ui.dev.grants.user_search_placeholder",
+                        "이름 또는 이메일 검색...",
+                      )}
+                      value={userSearch}
+                      onChange={(event) => {
+                        setSelectedUser(null);
+                        setUserSearch(event.target.value);
+                      }}
+                    />
+                  </div>
+                  {selectedUser && (
+                    <p className="text-xs text-muted-foreground">
+                      {t(
+                        "msg.dev.grants.selected_user",
+                        "선택된 사용자: {{user}}",
+                        { user: formatUserLabel(selectedUser) },
+                      )}
+                    </p>
+                  )}
+                </div>
+
+                {userSearch.trim() !== "" && selectedUser == null && (
+                  <div className="mt-2 max-h-64 overflow-y-auto rounded-lg border border-border/70 bg-muted/20 shadow-sm">
+                    {isUserSearchLoading ? (
+                      <div className="px-3 py-3 text-sm text-muted-foreground">
+                        {t(
+                          "msg.dev.grants.search_loading",
+                          "사용자를 찾는 중입니다...",
+                        )}
+                      </div>
+                    ) : (userSearchData?.items ?? []).length > 0 ? (
+                      (userSearchData?.items ?? []).map((user) => (
+                        <button
+                          key={user.id}
+                          type="button"
+                          className="flex w-full flex-col gap-1 border-b border-border/40 px-3 py-2 text-left last:border-b-0 hover:bg-primary/5"
+                          onMouseDown={(event) => {
+                            event.preventDefault();
+                            handleSelectUser(user);
+                          }}
+                        >
+                          <span className="text-sm font-semibold">
+                            {user.name || user.email}
+                          </span>
+                          <span className="text-xs text-muted-foreground">
+                            {user.email}
+                            {user.loginId ? ` · ${user.loginId}` : ""}
+                          </span>
+                        </button>
+                      ))
+                    ) : (
+                      <div className="px-3 py-4 text-center text-sm text-muted-foreground">
+                        {t(
+                          "msg.dev.grants.search_empty",
+                          "검색 결과가 없습니다.",
+                        )}
+                      </div>
+                    )}
+                  </div>
+                )}
+              </CardContent>
+            </Card>
+
+            <Card className="border-dashed bg-muted/20 shadow-none">
+              <CardHeader className="space-y-1 pb-3">
+                <div className="flex items-center justify-between gap-2">
+                  <CardTitle className="text-base">
+                    {t("ui.dev.grants.selected_info", "선택된 사용자 정보")}
+                  </CardTitle>
+                  <Badge variant="secondary">
+                    {t("ui.dev.grants.read_only", "읽기 전용")}
+                  </Badge>
+                </div>
+                <CardDescription>
+                  {t(
+                    "msg.dev.grants.selected_info_description",
+                    "선택된 사용자의 소속, 이메일, 전화번호를 확인합니다.",
+                  )}
+                </CardDescription>
+              </CardHeader>
+              <CardContent className="space-y-4 pt-0">
+                <div className="space-y-2">
+                  <Label htmlFor="tenant-readonly">
+                    {t("ui.dev.grants.tenant", "소속")}
+                  </Label>
+                  <Input
+                    id="tenant-readonly"
+                    className="border-dashed bg-background/70 text-foreground/90 shadow-none focus-visible:border-input focus-visible:ring-0 focus-visible:ring-offset-0"
+                    value={
+                      selectedUserDetail?.tenant?.name ||
+                      selectedUserDetail?.tenantSlug ||
+                      selectedUserDetail?.companyCode ||
+                      (selectedUser && !isSelectedUserDetailLoading
+                        ? t("ui.common.na", "없음")
+                        : "")
+                    }
+                    readOnly
+                    placeholder={
+                      selectedUser
+                        ? isSelectedUserDetailLoading
+                          ? t("msg.common.loading", "Loading...")
+                          : t(
+                              "msg.dev.grants.tenant_missing",
+                              "선택한 사용자의 테넌트 정보가 없습니다.",
+                            )
+                        : t(
+                            "msg.dev.grants.user_required",
+                            "부여할 사용자를 선택해주세요.",
+                          )
+                    }
+                  />
+                </div>
+
+                <div className="space-y-2">
+                  <Label htmlFor="email-readonly">
+                    {t("ui.dev.grants.email", "이메일")}
+                  </Label>
+                  <Input
+                    id="email-readonly"
+                    className="border-dashed bg-background/70 text-foreground/90 shadow-none focus-visible:border-input focus-visible:ring-0 focus-visible:ring-offset-0"
+                    value={
+                      selectedUserDetail?.email || selectedUser?.email || ""
+                    }
+                    readOnly
+                    placeholder={t(
+                      "msg.dev.grants.user_required",
+                      "부여할 사용자를 선택해주세요.",
+                    )}
+                  />
+                </div>
+
+                <div className="space-y-2">
+                  <Label htmlFor="phone-readonly">
+                    {t("ui.dev.grants.phone", "전화번호")}
+                  </Label>
+                  <Input
+                    id="phone-readonly"
+                    className="border-dashed bg-background/70 text-foreground/90 shadow-none focus-visible:border-input focus-visible:ring-0 focus-visible:ring-offset-0"
+                    value={selectedUserDetail?.phone || ""}
+                    readOnly
+                    placeholder={t(
+                      "msg.dev.grants.phone_missing",
+                      "등록된 전화번호가 없습니다.",
+                    )}
+                  />
+                </div>
+
+                <div className="space-y-2">
+                  <Label>
+                    {t("ui.dev.grants.pages", "권한 페이지")}{" "}
+                    <span className="text-destructive">*</span>
+                  </Label>
+                  <div className="grid gap-2 rounded-lg border border-border/60 bg-muted/20 p-3">
+                    {developerAccessPageOptions.map((option) => {
+                      const checked =
+                        option.value === "all"
+                          ? selectedAccessPages.includes("all")
+                          : selectedAccessPages.includes(option.value);
+                      return (
+                        <label
+                          key={option.value}
+                          className="flex items-center gap-3 rounded-md px-2 py-1.5 text-sm hover:bg-background/60"
+                        >
+                          <input
+                            type="checkbox"
+                            checked={checked}
+                            onChange={() =>
+                              handleAccessPageToggle(option.value)
+                            }
+                          />
+                          <span className="font-medium">{option.label}</span>
+                        </label>
+                      );
+                    })}
+                  </div>
+                  <p className="text-xs text-muted-foreground">
+                    {t(
+                      "msg.dev.grants.pages_hint",
+                      "전체를 선택하면 개요, 연동 앱 추가, 감사로그가 모두 포함됩니다.",
+                    )}
+                  </p>
+                </div>
+              </CardContent>
+            </Card>
+          </div>
+
+          <Card className="border-border/70 bg-background/80 shadow-sm">
+            <CardHeader className="space-y-1 pb-3">
+              <div className="flex items-center justify-between gap-2">
+                <CardTitle className="text-base">
+                  {t("ui.dev.grants.admin_notes", "부여 사유")}
+                </CardTitle>
+              </div>
+              <CardDescription>
+                {t(
+                  "msg.dev.grants.admin_notes_description",
+                  "직접 부여의 근거를 간단히 남겨 두면 추후 회수와 검토에 도움이 됩니다.",
+                )}
+              </CardDescription>
+            </CardHeader>
+            <CardContent className="space-y-3 pt-0">
+              <Textarea
+                id="admin-notes"
+                value={grantNotes}
+                onChange={(event) => setGrantNotes(event.target.value)}
+                className="min-h-[132px] bg-background"
+                placeholder={t(
+                  "msg.dev.grants.admin_notes_placeholder",
+                  "예: 테스트 환경 확인 후 권한 부여",
+                )}
+              />
+              <p className="text-xs text-muted-foreground">
+                {t(
+                  "msg.dev.grants.admin_notes_hint",
+                  "회수는 목록의 회수 버튼으로 처리합니다.",
+                )}
+              </p>
+            </CardContent>
+          </Card>
+
+          <div className="flex justify-end">
+            <Button
+              onClick={handleGrant}
+              disabled={createGrantMutation.isPending}
+              className="gap-2"
+            >
+              <Plus className="h-4 w-4" />
+              {createGrantMutation.isPending
+                ? t("ui.common.submitting", "제출 중...")
+                : t("ui.dev.grants.grant", "직접 부여")}
+            </Button>
+          </div>
+        </CardContent>
+      </Card>
+
+      <Card className="glass-panel">
+        <CardHeader>
+          <CardTitle className="text-xl">
+            {t("ui.dev.grants.list.title", "부여된 권한")}
+          </CardTitle>
+          <CardDescription>
+            {t(
+              "msg.dev.grants.list.description",
+              "현재 부여된 개발자 권한 목록입니다.",
+            )}
+          </CardDescription>
+        </CardHeader>
+        <CardContent>
+          {isLoadingGrants ? (
+            <div className="py-8 text-center text-sm text-muted-foreground">
+              {t("msg.common.loading", "Loading...")}
+            </div>
+          ) : grantsError ? (
+            <div className="rounded-md border border-destructive/30 bg-destructive/5 p-4 text-sm text-destructive">
+              {t(
+                "msg.dev.grants.load_error",
+                "개발자 권한 목록을 불러오지 못했습니다.",
+              )}
+            </div>
+          ) : filteredGrantedUsers.length === 0 ? (
+            <div className="py-8 text-center text-sm text-muted-foreground">
+              {t("msg.dev.grants.empty", "부여된 권한이 없습니다.")}
+            </div>
+          ) : (
+            <Table>
+              <TableHeader>
+                <TableRow>
+                  <TableHead>{t("ui.dev.grants.user", "사용자")}</TableHead>
+                  <TableHead>{t("ui.dev.grants.tenant", "테넌트")}</TableHead>
+                  <TableHead>
+                    {t("ui.dev.grants.reason", "부여 사유")}
+                  </TableHead>
+                  <TableHead>
+                    {t("ui.dev.grants.pages", "권한 페이지")}
+                  </TableHead>
+                  <TableHead>{t("ui.dev.grants.status", "상태")}</TableHead>
+                  <TableHead>{t("ui.dev.grants.date", "부여일")}</TableHead>
+                  <TableHead className="text-right">
+                    {t("ui.dev.grants.actions", "관리")}
+                  </TableHead>
+                </TableRow>
+              </TableHeader>
+              <TableBody>
+                {filteredGrantedUsers.map((grant) => (
+                  <TableRow key={grant.id}>
+                    <TableCell>
+                      <div className="space-y-1">
+                        <div className="font-medium">
+                          {grant.name || grant.email || grant.userId}
+                        </div>
+                        <div className="text-xs text-muted-foreground">
+                          {grant.email || grant.userId}
+                        </div>
+                        <div className="font-mono text-xs text-muted-foreground">
+                          {grant.userId}
+                        </div>
+                      </div>
+                    </TableCell>
+                    <TableCell>
+                      <div className="space-y-1">
+                        <div className="font-medium">
+                          {grant.organization ||
+                            grant.tenantId ||
+                            t("ui.common.na", "없음")}
+                        </div>
+                        <div className="font-mono text-xs text-muted-foreground">
+                          {grant.tenantId || t("ui.common.na", "없음")}
+                        </div>
+                      </div>
+                    </TableCell>
+                    <TableCell className="max-w-md">
+                      <div className="truncate" title={grant.reason}>
+                        {grant.reason}
+                      </div>
+                      {grant.adminNotes && (
+                        <div className="mt-1 text-xs text-muted-foreground">
+                          {grant.adminNotes}
+                        </div>
+                      )}
+                    </TableCell>
+                    <TableCell>
+                      <div className="flex flex-wrap gap-1">
+                        {(grant.accessPages?.length
+                          ? normalizeDeveloperAccessPages(grant.accessPages)
+                          : ["all"]
+                        ).map((page) => (
+                          <Badge key={page} variant="outline">
+                            {developerAccessPageOptions.find(
+                              (option) => option.value === page,
+                            )?.label ?? page}
+                          </Badge>
+                        ))}
+                      </div>
+                    </TableCell>
+                    <TableCell>
+                      <Badge variant="success">
+                        {t("ui.dev.grants.approved", "승인됨")}
+                      </Badge>
+                    </TableCell>
+                    <TableCell className="text-sm text-muted-foreground">
+                      {new Date(grant.createdAt).toLocaleDateString()}
+                    </TableCell>
+                    <TableCell className="text-right">
+                      <div className="ml-auto flex min-w-[220px] flex-col items-end gap-2">
+                        <Input
+                          placeholder={t(
+                            "ui.dev.grants.revoke_notes_placeholder",
+                            "회수 메모 (선택)...",
+                          )}
+                          className="h-8 text-xs"
+                          value={adminNotes[grant.id] || ""}
+                          onChange={(event) =>
+                            setAdminNotes({
+                              ...adminNotes,
+                              [grant.id]: event.target.value,
+                            })
+                          }
+                        />
+                        <Button
+                          size="sm"
+                          variant="outline"
+                          className="text-destructive hover:bg-destructive/10"
+                          disabled={revokeGrantMutation.isPending}
+                          onClick={() => {
+                            revokeGrantMutation.mutate({
+                              id: grant.id,
+                              adminNotes: adminNotes[grant.id] || "",
+                            });
+                          }}
+                        >
+                          <X className="mr-1 h-3 w-3" />
+                          {t("ui.dev.grants.revoke", "회수")}
+                        </Button>
+                      </div>
+                    </TableCell>
+                  </TableRow>
+                ))}
+              </TableBody>
+            </Table>
+          )}
+        </CardContent>
+      </Card>
+    </div>
+  );
+}

devfront/src/features/developer-request/DeveloperRequestPage.test.tsx

@@ -141,6 +141,34 @@ async function renderPage() {
 }
 
 describe("DeveloperRequestPage", () => {
+  it("shows selected access pages in the request list", async () => {
+    fetchDeveloperRequestsMock.mockResolvedValueOnce([
+      {
+        id: 1,
+        userId: "user-1",
+        tenantId: "tenant-1",
+        name: "Requester",
+        organization: "Hanmac",
+        email: "requester@example.com",
+        phone: "010-1234-5678",
+        role: "user",
+        reason: "Need RP access",
+        accessPages: ["overview", "audit"],
+        status: "pending",
+        createdAt: "2026-06-09T00:00:00Z",
+        updatedAt: "2026-06-09T00:00:00Z",
+      },
+    ]);
+
+    const container = await renderPage();
+    const pageCell = container.querySelector(
+      "table tbody tr td:nth-child(3)",
+    ) as HTMLTableCellElement | null;
+    expect(pageCell?.textContent).toContain("개요");
+    expect(pageCell?.textContent).toContain("감사로그");
+    expect(pageCell?.textContent).not.toContain("전체");
+  });
+
   it("opens the request modal and submits a request", async () => {
     const container = await renderPage();
     expect(container.textContent).toContain("신규 신청하기");
@@ -183,6 +211,115 @@ describe("DeveloperRequestPage", () => {
       organization: "Hanmac",
       reason: "Need RP access",
       tenantId: "tenant-1",
+      accessPages: ["all"],
     });
   });
+
+  it("allows requesting developer access even when tenant context is missing", async () => {
+    authState = {
+      user: {
+        access_token: "access-token",
+        profile: {
+          role: "user",
+          companyCode: "HANMAC",
+          name: "Requester",
+          email: "requester@example.com",
+          phone: "010-1234-5678",
+        },
+      },
+    };
+    fetchMeMock.mockResolvedValue({
+      id: "user-1",
+      name: "Requester",
+      email: "requester@example.com",
+      phone: "010-1234-5678",
+      role: "user",
+    });
+    fetchMyTenantsMock.mockResolvedValue([]);
+
+    const container = await renderPage();
+    expect(container.textContent).toContain("신규 신청하기");
+    expect(container.textContent).not.toContain(
+      "개발자 권한을 신청하려면 먼저 테넌트에 소속되어 있어야 합니다.",
+    );
+
+    const actionButton = Array.from(container.querySelectorAll("button")).find(
+      (button) => button.textContent?.includes("신규 신청하기"),
+    );
+    expect(actionButton).toBeTruthy();
+
+    await act(async () => {
+      actionButton?.dispatchEvent(new MouseEvent("click", { bubbles: true }));
+    });
+
+    expect(container.textContent).toContain("개발자 등록 신청");
+
+    const reasonField = container.querySelector(
+      "textarea",
+    ) as HTMLTextAreaElement | null;
+    if (!reasonField) {
+      throw new Error("Expected reason textarea to be rendered");
+    }
+
+    await act(async () => {
+      await setTextAreaValue(reasonField, "Need RP access");
+    });
+
+    const submitButton = Array.from(container.querySelectorAll("button")).find(
+      (button) => button.textContent === "신청하기",
+    );
+    expect(submitButton).toBeTruthy();
+
+    await act(async () => {
+      submitButton?.dispatchEvent(new MouseEvent("click", { bubbles: true }));
+      await new Promise((resolve) => setTimeout(resolve, 0));
+    });
+
+    expect(requestDeveloperAccessMock.mock.calls[0]?.[0]).toEqual({
+      name: "Requester",
+      organization: "HANMAC",
+      reason: "Need RP access",
+      tenantId: "",
+      accessPages: ["all"],
+    });
+  });
+
+  it("shows '없음' when organization is unavailable", async () => {
+    authState = {
+      user: {
+        access_token: "access-token",
+        profile: {
+          role: "user",
+          name: "Requester",
+          email: "requester@example.com",
+          phone: "010-1234-5678",
+        },
+      },
+    };
+    fetchMeMock.mockResolvedValue({
+      id: "user-1",
+      name: "Requester",
+      email: "requester@example.com",
+      phone: "010-1234-5678",
+      role: "user",
+    });
+    fetchMyTenantsMock.mockResolvedValue([]);
+
+    const container = await renderPage();
+    const actionButton = Array.from(container.querySelectorAll("button")).find(
+      (button) => button.textContent?.includes("신규 신청하기"),
+    );
+    expect(actionButton).toBeTruthy();
+
+    await act(async () => {
+      actionButton?.dispatchEvent(new MouseEvent("click", { bubbles: true }));
+    });
+
+    const orgField = container.querySelector("#org") as HTMLInputElement | null;
+    if (!orgField) {
+      throw new Error("Expected organization input to be rendered");
+    }
+
+    expect(orgField.value).toBe("없음");
+  });
 });

devfront/src/features/developer-request/DeveloperRequestPage.tsx

@@ -47,6 +47,12 @@ import {
 import { t } from "../../lib/i18n";
 import { resolveProfileRole } from "../../lib/role";
 import { fetchMe } from "../auth/authApi";
+import {
+  type DeveloperAccessPage,
+  developerAccessPageOptions,
+  normalizeDeveloperAccessPageSelection,
+  normalizeDeveloperAccessPages,
+} from "../developer-access/developerAccessPages";
 
 export default function DeveloperRequestPage() {
   const auth = useAuth();
@@ -152,9 +158,7 @@ export default function DeveloperRequestPage() {
     );
   }
 
-  const hasActiveRequest = requests?.some(
-    (r) => r.status === "pending" || r.status === "approved",
-  );
+  const hasActiveRequest = requests?.some((r) => r.status === "pending");
   const approvedRequestCount =
     requests?.filter((request) => request.status === "approved").length ?? 0;
   const isActionPending =
@@ -218,6 +222,9 @@ export default function DeveloperRequestPage() {
                     <TableHead>
                       {t("ui.dev.request.table.reason", "신청 사유")}
                     </TableHead>
+                    <TableHead>
+                      {t("ui.dev.request.table.pages", "권한 페이지")}
+                    </TableHead>
                     <TableHead>
                       {t("ui.dev.request.table.status", "상태")}
                     </TableHead>
@@ -235,7 +242,7 @@ export default function DeveloperRequestPage() {
                   {!requests || requests.length === 0 ? (
                     <TableRow>
                       <TableCell
-                        colSpan={isSuperAdmin ? 6 : 4}
+                        colSpan={isSuperAdmin ? 7 : 5}
                         className="h-32 text-center text-muted-foreground"
                       >
                         {t("msg.dev.request.empty", "신청 내역이 없습니다.")}
@@ -259,7 +266,10 @@ export default function DeveloperRequestPage() {
                             )}
                           </TableCell>
                         )}
-                        <TableCell>{req.organization}</TableCell>
+                        <TableCell>
+                          {req.organization?.trim() ||
+                            t("ui.common.na", "없음")}
+                        </TableCell>
                         <TableCell className="max-w-md">
                           <div className="truncate" title={req.reason}>
                             {req.reason}
@@ -270,6 +280,25 @@ export default function DeveloperRequestPage() {
                             </div>
                           )}
                         </TableCell>
+                        <TableCell>
+                          <div className="flex flex-wrap gap-1">
+                            {req.accessPages?.length ? (
+                              normalizeDeveloperAccessPages(
+                                req.accessPages,
+                              ).map((page) => (
+                                <Badge key={page} variant="outline">
+                                  {developerAccessPageOptions.find(
+                                    (option) => option.value === page,
+                                  )?.label ?? page}
+                                </Badge>
+                              ))
+                            ) : (
+                              <Badge variant="secondary">
+                                {t("ui.common.na", "없음")}
+                              </Badge>
+                            )}
+                          </div>
+                        </TableCell>
                         <TableCell>
                           <StatusBadge status={req.status} />
                         </TableCell>
@@ -447,11 +476,16 @@ function RequestAccessModal({
   const [name, setName] = useState(initialName);
   const [organization, setOrganization] = useState(initialOrg);
   const [reason, setReason] = useState("");
+  const [accessPages, setAccessPages] = useState<DeveloperAccessPage[]>([
+    "all",
+  ]);
+  const organizationDisplay = organization.trim() || t("ui.common.na", "없음");
 
   useEffect(() => {
     if (!isOpen) return;
     setName(initialName);
     setOrganization(initialOrg);
+    setAccessPages(["all"]);
   }, [initialName, initialOrg, isOpen]);
 
   const mutation = useMutation({
@@ -468,6 +502,21 @@ function RequestAccessModal({
       organization,
       reason,
       tenantId,
+      accessPages: normalizeDeveloperAccessPageSelection(accessPages),
+    });
+  };
+
+  const handleAccessPageToggle = (page: DeveloperAccessPage) => {
+    setAccessPages((current) => {
+      if (page === "all") {
+        return ["all"];
+      }
+      const withoutAll = current.filter((item) => item !== "all");
+      if (withoutAll.includes(page)) {
+        const next = withoutAll.filter((item) => item !== page);
+        return next.length > 0 ? next : ["all"];
+      }
+      return normalizeDeveloperAccessPageSelection([...withoutAll, page]);
     });
   };
 
@@ -518,7 +567,7 @@ function RequestAccessModal({
               </Label>
               <Input
                 id="org"
-                value={organization}
+                value={organizationDisplay}
                 readOnly
                 className="focus-visible:ring-0 focus-visible:ring-offset-0 focus-visible:border-input"
                 required
@@ -559,6 +608,39 @@ function RequestAccessModal({
                 className="focus-visible:ring-0 focus-visible:ring-offset-0 focus-visible:border-input"
               />
             </div>
+            <div className="grid gap-3">
+              <Label>
+                {t("ui.dev.request.modal.pages", "권한 페이지")}{" "}
+                <span className="text-destructive">*</span>
+              </Label>
+              <div className="grid gap-2 rounded-lg border border-border/60 bg-muted/20 p-3">
+                {developerAccessPageOptions.map((option) => {
+                  const checked =
+                    option.value === "all"
+                      ? accessPages.includes("all")
+                      : accessPages.includes(option.value);
+                  return (
+                    <label
+                      key={option.value}
+                      className="flex items-center gap-3 rounded-md px-2 py-1.5 text-sm hover:bg-background/60"
+                    >
+                      <input
+                        type="checkbox"
+                        checked={checked}
+                        onChange={() => handleAccessPageToggle(option.value)}
+                      />
+                      <span className="font-medium">{option.label}</span>
+                    </label>
+                  );
+                })}
+              </div>
+              <p className="text-xs text-muted-foreground">
+                {t(
+                  "msg.dev.request.modal.pages_hint",
+                  "전체를 선택하면 개요, 연동 앱 추가, 감사로그가 모두 포함됩니다.",
+                )}
+              </p>
+            </div>
             <div className="grid gap-2">
               <Label htmlFor="reason">
                 {t("ui.dev.request.modal.reason", "신청 사유")}{" "}

devfront/src/features/overview/GlobalOverviewPage.tsx

@@ -972,6 +972,7 @@ function GlobalOverviewPage() {
     hasAccessToken,
     profileRole,
     tenantId,
+    requiredPages: ["overview"],
     isLoadingIdentity: isLoadingMe,
   });
   const distribution = useMemo(
@@ -1275,14 +1276,14 @@ function GlobalOverviewPage() {
           "msg.dev.dashboard.access_pending",
           "개발자 권한 신청을 검토 중입니다.",
         )}
-        deniedMessage={t(
-          "msg.dev.dashboard.access_denied",
-          "대시보드는 개발자 권한이 있어야 볼 수 있습니다.",
-        )}
         pendingDetailMessage={t(
           "msg.dev.dashboard.access_pending_detail",
           "super admin이 승인하면 개요와 개발자 기능을 사용할 수 있습니다.",
         )}
+        deniedMessage={t(
+          "msg.dev.dashboard.access_denied",
+          "대시보드는 개발자 권한이 있어야 볼 수 있습니다.",
+        )}
         deniedDetailMessage={t(
           "msg.dev.dashboard.access_denied_detail",
           "개발자 권한 신청 페이지에서 신청을 등록한 뒤 승인을 받아주세요.",

devfront/src/lib/devApi.test.ts

@@ -173,6 +173,7 @@ describe("devApi", () => {
       organization: "Hanmac",
       reason: "Need RP access",
       tenantId: "tenant-a",
+      accessPages: ["all"],
     });
     await approveDeveloperRequest(1, "approved");
     await rejectDeveloperRequest(2, "rejected");
@@ -238,6 +239,7 @@ describe("devApi", () => {
       organization: "Hanmac",
       reason: "Need RP access",
       tenantId: "tenant-a",
+      accessPages: ["all"],
     });
     expect(apiClient.post).toHaveBeenCalledWith(
       "/dev/developer-request/1/approve",

devfront/src/lib/devApi.ts

@@ -530,14 +530,23 @@ export type DeveloperRequest = {
   phone?: string;
   role?: string;
   reason: string;
+  accessPages?: string[];
   status: DeveloperRequestStatus;
   adminNotes?: string;
   createdAt: string;
   updatedAt: string;
 };
 
+export type DeveloperGrant = DeveloperRequest;
+
+export type DeveloperAccessStatus = {
+  status: DeveloperRequestStatus | "none";
+  approvedPages?: string[];
+  pendingPages?: string[];
+};
+
 export async function fetchDeveloperRequestStatus(tenantId?: string) {
-  const { data } = await apiClient.get<DeveloperRequest | { status: "none" }>(
+  const { data } = await apiClient.get<DeveloperAccessStatus>(
     "/dev/developer-request/status",
     {
       params: { tenantId },
@@ -551,6 +560,7 @@ export async function requestDeveloperAccess(payload: {
   organization: string;
   reason: string;
   tenantId: string;
+  accessPages: string[];
 }) {
   const { data } = await apiClient.post<{ status: string }>(
     "/dev/developer-request",
@@ -595,3 +605,35 @@ export async function cancelDeveloperRequestApproval(
   );
   return data;
 }
+
+export async function fetchDeveloperGrants(tenantId?: string) {
+  const { data } = await apiClient.get<DeveloperGrant[]>(
+    "/dev/developer-grants",
+    {
+      params: { tenantId },
+    },
+  );
+  return data;
+}
+
+export async function createDeveloperGrant(payload: {
+  userId: string;
+  tenantId: string;
+  reason?: string;
+  adminNotes?: string;
+  accessPages: string[];
+}) {
+  const { data } = await apiClient.post<DeveloperGrant>(
+    "/dev/developer-grants",
+    payload,
+  );
+  return data;
+}
+
+export async function revokeDeveloperGrant(id: number, adminNotes: string) {
+  const { data } = await apiClient.post<{ status: string }>(
+    `/dev/developer-grants/${id}/revoke`,
+    { adminNotes },
+  );
+  return data;
+}

devfront/src/lib/role.test.ts

@@ -3,11 +3,8 @@ import { normalizeRole, resolveProfileRole } from "./role";
 
 describe("normalizeRole", () => {
   it("normalizes known role aliases", () => {
-    expect(normalizeRole("tenant_member")).toBe("user");
     expect(normalizeRole("admin")).toBe("user");
     expect(normalizeRole("superadmin")).toBe("super_admin");
-    expect(normalizeRole("tenantadmin")).toBe("tenant_admin");
-    expect(normalizeRole("rpadmin")).toBe("rp_admin");
   });
 
   it("returns 'user' for unknown string values and empty string for non-strings", () => {
@@ -21,7 +18,7 @@ describe("resolveProfileRole", () => {
     expect(
       resolveProfileRole({
         role: " ",
-        grade: "tenant_member",
+        grade: " ",
         "custom:role": "admin",
       }),
     ).toBe("user");

devfront/src/lib/role.ts

@@ -7,14 +7,6 @@ export function normalizeRole(rawRole: unknown): string {
     case "superadmin":
     case "super-admin":
       return "super_admin";
-    case "rp_admin":
-    case "rpadmin":
-    case "rp-admin":
-      return "rp_admin";
-    case "tenant_admin":
-    case "tenantadmin":
-    case "tenant-admin":
-      return "tenant_admin";
     default:
       return "user";
   }

devfront/src/locales/en.toml

@@ -329,6 +329,9 @@ user_desc = "Review your request history and submit a new access request."
 
 [msg.dev.request.modal]
 desc = "Please enter the reason for your request. It will be approved after administrator review."
+tenant_required = "Please submit a developer access request."
+tenant_required_detail = "Enter a request reason and submit it for administrator review."
+pages_hint = "If you select All, Overview, Add linked app, and Audit Logs are all included."
 
 [msg.dev.clients]
 load_error = "Error loading clients: {{error}}"
@@ -342,12 +345,16 @@ empty_detail = "RPs will appear here when a relationship is assigned to your acc
 empty_can_create = "No linked apps have been registered yet."
 empty_can_create_detail = "Create a new RP with the Add linked app button, and it will appear here."
 create_requires_request = "You do not have permission to create applications.\nSubmit a developer access request and wait for approval."
+create_requires_tenant = "Please submit a developer access request."
+create_requires_tenant_detail = "Enter a request reason and submit it for administrator review."
 create_pending_detail = "Your developer access request is under review. You will be able to add applications after approval."
 create_forbidden_detail = "You do not have permission to create applications. Ask an administrator to grant developer access or the appropriate RP permissions."
 empty_filtered = "No linked apps match the current filters."
 empty_filtered_detail = "Try changing the search text or filters."
 empty_pending = "Your developer access request is under review."
 empty_pending_detail = "You can add linked apps after a super admin approves it."
+empty_tenant_missing = "Please submit a developer access request."
+empty_tenant_missing_detail = "Enter a request reason and submit it for administrator review."
 
 [msg.dev.clients.consents]
 empty = "No consents found."
@@ -447,13 +454,14 @@ subtitle = "Define the permission scopes this application can request."
 tenant = "Tenant access claim"
 
 [msg.dev.clients.general.id_token_claims]
-subtitle = "Separate shared claims from RP-specific extension claims."
+subtitle = "Manage RP-specific extension claims separately."
 empty = "No ID Token claims have been added yet."
-hint = "Manage RP-specific extension claims only. Arrays accept JSON or comma-separated values, and objects accept JSON."
+hint = "Manage RP-specific extension claims separately. Edit per-user claim values in Consents & Claims."
 preview_hint = "Preview the metadata.id_token_claims structure that will be saved."
 key_required = "Enter a claim key."
 reserved_key = "`rp_claims` is a reserved namespace key."
 duplicate_key = "Duplicate claim key: {{namespace}}.{{key}}"
+invalid_default_value = "The claim default value does not match its type: {{key}} ({{valueType}})"
 
 [msg.dev.clients.general.security]
 private_help = "Server side App: For apps that can safely store a client secret, such as Node.js or Java servers."
@@ -537,6 +545,7 @@ unavailable_with_reason = "RP usage statistics API is unavailable. {{reason}}"
 audit = "Review RP configuration changes and operational history."
 clients = "Browse registered RPs and manage their status and type."
 description = "Jump directly to key operational screens."
+developer_grants = "Directly grant or revoke developer access for users."
 developer_request = "Review developer access requests or submit a new one."
 new_client = "Configure redirect URIs, grant types, and authentication methods."
 
@@ -548,6 +557,33 @@ none = "No connected applications to display."
 description = "Review trends for changed or deleted applications on the dashboard."
 empty = "There are no recent change logs yet."
 
+[msg.dev.grants]
+approved = "Approved"
+count = "Total {{count}}"
+create_success = "Developer access has been granted directly."
+description = "Directly grant developer access to users and revoke granted access."
+admin_notes_hint = "Revocations are handled from the list below."
+admin_notes_description = "Leaving a short note for the direct grant helps later reviews and revocations."
+admin_notes_placeholder = "e.g. Grant access after verifying the test environment"
+empty = "There are no granted permissions."
+forbidden = "Only super admin can directly grant developer access."
+forbidden_desc = "This screen is available only to super admin."
+form.description = "Select a user to view their current tenant, email, and phone, then grant developer access immediately."
+selected_info_description = "Review the selected user's tenant, email, and phone."
+user_section_description = "Enter a search term to select a user. The next-step information stays empty until a user is chosen."
+list.description = "Current developer access grants."
+load_error = "Failed to load developer access grants."
+reason = "Grant reason"
+revoke = "Revoke"
+revoke_success = "Developer access has been revoked."
+search_empty = "No users found."
+search_loading = "Searching users..."
+selected_user = "Selected user: {{user}}"
+tenant_required = "The selected user's tenant information is unavailable."
+tenant_missing = "No tenant information is available for the selected user."
+user_required = "Select a user before granting access."
+phone_missing = "No phone number is registered."
+
 [msg.dev.dashboard.notice]
 consent_audit = "Consent Audit"
 dev_scope = "Dev Scope"
@@ -1001,11 +1037,8 @@ total_tenants = "Total Tenants"
 manageable_tenants = "Manageable Tenants"
 
 [ui.admin.role]
-rp_admin = "Service Administrator (RP Admin)"
 super_admin = "System Administrator (Super Admin)"
-tenant_admin = "Tenant Administrator (Tenant Admin)"
-tenant_member = "General User (Tenant Member)"
-user = "General User (Tenant Member)"
+user = "General User"
 
 [ui.admin.tenants]
 add = "Add Tenant"
@@ -1291,6 +1324,7 @@ scope_badge = "Scoped to /dev"
 audit_logs = "Audit Logs"
 clients = "Connected Application"
 developer_request = "Developer Access Request"
+developer_grants = "Developer Access Grants"
 logout = "Logout"
 overview = "Overview"
 
@@ -1306,10 +1340,35 @@ cancel_notes_placeholder = "Enter reason for approval cancellation..."
 [ui.dev.request.list]
 title = "Request History"
 
+[ui.dev.grants]
+actions = "Actions"
+admin_notes = "Grant Reason"
+all_tenants = "All Tenants"
+approved = "Approved"
+date = "Granted At"
+form.title = "Direct Grant"
+grant = "Grant Directly"
+input_section = "Input"
+list.title = "Granted Access"
+pages = "Access Pages"
+read_only = "Read Only"
+reason = "Grant Reason"
+reason_placeholder = "e.g. Developer console access is required for operational support."
+required = "Required"
+selected_info = "Selected User Info"
+revoke = "Revoke"
+revoke_notes_placeholder = "Revoke note (optional)..."
+status = "Status"
+tenant = "Affiliation"
+user_section = "User Selection"
+user = "User"
+user_search_placeholder = "Search by name or email..."
+
 [ui.dev.request.modal]
 email = "Email"
 name = "Name"
 org = "Organization"
+pages = "Access Pages"
 phone = "Phone Number"
 reason = "Reason"
 reason_placeholder = "e.g. I need to create an OIDC client for internal service integration and testing."
@@ -1327,6 +1386,7 @@ actions = "Actions"
 date = "Requested At"
 org = "Organization"
 reason = "Reason"
+pages = "Access Pages"
 status = "Status"
 user = "User"
 
@@ -1366,15 +1426,13 @@ collapse = "Collapse sidebar"
 expand = "Expand sidebar"
 
 [ui.shell.role]
-rp_admin = "Service Administrator (RP Admin)"
 super_admin = "System Administrator (Super Admin)"
-tenant_admin = "Tenant Administrator (Tenant Admin)"
-user = "General User (Tenant Member)"
+user = "General User"
 
 [ui.dev.clients]
 new = "Add Connected Application"
 search_placeholder = "Search by app name or ID..."
-tenant_scoped = "Tenant-scoped"
+tenant_limited = "Tenant-limited"
 untitled = "Untitled"
 
 [ui.dev.clients.recent_changes]
@@ -1480,10 +1538,10 @@ title = "Security Note"
 
 [ui.dev.clients.details.tab]
 connection = "Federation"
-consents = "Consent & Users"
+consents = "Consents & Claims"
 settings = "Settings"
 relationships = "Relationships"
-user_claims = "User Claims"
+user_claims = "Consents & Claims"
 
 [ui.dev.clients.general]
 create = "Create Application"
@@ -1560,14 +1618,26 @@ preview_title = "Saved JSON Preview"
 namespace_label = "Claim namespace"
 namespace_top_level = "top-level"
 namespace_rp_claims = "rp_claims"
+nullable_label = "Nullable"
+read_user_allowed_label = "Allow user read"
+write_user_allowed_label = "Allow user write"
+table.key = "Claim Key"
+table.namespace = "Namespace"
+table.value_type = "Value Type"
+table.nullable = "Nullable"
+table.read_user_allowed = "User read"
+table.write_user_allowed = "User write"
+table.default_value = "Default Value"
+table.delete = "Delete"
 value_type_label = "Claim value type"
 value_type_text = "Text"
 value_type_number = "Number"
+value_type_float = "Float"
 value_type_boolean = "Boolean"
 value_type_array = "Array"
 value_type_object = "Object"
 key_placeholder = "e.g. locale"
-value_placeholder = "Enter the claim value"
+value_placeholder = "Enter the default value"
 
 [ui.dev.clients.general.security]
 private = "Server Side App"
@@ -2043,10 +2113,7 @@ title = "System Role"
 description = "The permission level granted to this account."
 current = "Current Role"
 desc_super_admin = "Can manage all tenants and applications system-wide without restriction."
-desc_tenant_admin = "Can manage all applications within their assigned tenant."
-desc_rp_admin = "Can view and manage only assigned/linked applications."
 desc_user = "Standard application access. DevFront access is denied."
-desc_tenant_member = "Standard application access. DevFront access is denied."
 
 [ui.admin.nav]
 api_keys = "API Keys"
@@ -2068,9 +2135,10 @@ single_notice = "You belong to a single tenant and do not need to switch."
 
 [msg.dev.forbidden]
 default = "You do not have permission to access this resource. Please contact an administrator."
-rp_admin = "RP administrators can only view resources for their assigned apps."
-tenant_admin = "Tenant administrator permissions are not configured correctly or have expired."
 user.clients = "General user accounts can only use this feature if they have been granted operational or management relationships for the relevant RP (App). If you need access, please request it from an administrator."
-user.consents = "Viewing consent history for this App (RP) is only available when granted 'RP Admin', 'Consent View', or 'Consent Revoke' relationships. If you need access, please request it from an administrator."
-user.audit = "Viewing audit logs for this App (RP) is only available when granted 'RP Admin' or 'Audit View' relationships. If you need access, please request it from an administrator."
+user.consents = "Viewing consent history for this App (RP) is only available when granted operational, consent view, or consent revoke relationships. If you need access, please request it from an administrator."
+user.audit = "Viewing audit logs for this App (RP) is only available when granted operational or audit view relationships. If you need access, please request it from an administrator."
 title = "Access Denied: {{resource}}"
+
+[ui.common]
+na = "N/A"

devfront/src/locales/ko.toml

@@ -329,6 +329,9 @@ user_desc = "내 신청 내역을 확인하고 새로운 권한을 신청할 수
 
 [msg.dev.request.modal]
 desc = "신청 사유를 입력해 주세요. 관리자 확인 후 승인됩니다."
+tenant_required = "개발자 권한 신청을 진행해 주세요."
+tenant_required_detail = "신청 사유를 입력해 제출하면 관리자 검토 후 승인됩니다."
+pages_hint = "전체를 선택하면 개요, 연동 앱 추가, 감사로그가 모두 포함됩니다."
 
 [msg.dev.clients]
 deleted = "앱이 삭제되었습니다."
@@ -339,12 +342,16 @@ empty_detail = "RP 관계가 부여되면 이 목록에 해당 RP가 표시됩
 empty_can_create = "아직 등록된 연동 앱이 없습니다."
 empty_can_create_detail = "연동 앱 추가 버튼으로 새 RP를 생성하면 이 목록에 표시됩니다."
 create_requires_request = "연동 앱을 생성할 권한이 없습니다.\n개발자 권한 신청을 요청한 뒤 승인 받아주세요."
+create_requires_tenant = "개발자 권한 신청을 진행해 주세요."
+create_requires_tenant_detail = "신청 사유를 입력해 제출하면 관리자 검토 후 승인됩니다."
 create_pending_detail = "개발자 권한 신청을 검토 중입니다. 승인되면 연동 앱을 추가할 수 있습니다."
 create_forbidden_detail = "연동 앱을 생성할 권한이 없습니다. 관리자에게 개발자 권한 또는 적절한 RP 권한 부여를 요청해 주세요."
 empty_filtered = "조건에 맞는 연동 앱이 없습니다."
 empty_filtered_detail = "검색어나 필터 조건을 변경해 보세요."
 empty_pending = "개발자 권한 신청을 검토 중입니다."
 empty_pending_detail = "super admin이 승인하면 연동 앱을 추가할 수 있습니다."
+empty_tenant_missing = "개발자 권한 신청을 진행해 주세요."
+empty_tenant_missing_detail = "신청 사유를 입력해 제출하면 관리자 검토 후 승인됩니다."
 load_error = "앱 정보를 불러오지 못했습니다: {{error}}"
 loading = "앱 정보를 불러오는 중..."
 showing = "총 {{shown}}개의 애플리케이션이 등록되어 있습니다."
@@ -447,13 +454,14 @@ subtitle = "이 앱이 요청할 수 있는 권한 범위를 정의합니다."
 tenant = "소속 테넌트 정보 접근"
 
 [msg.dev.clients.general.id_token_claims]
-subtitle = "공통 claim과 RP 전용 확장 claim을 구분해서 관리합니다."
+subtitle = "RP 전용 확장 claim을 구분해서 관리합니다."
 empty = "아직 추가된 ID Token claim이 없습니다."
-hint = "RP 전용 확장 claim만 관리합니다. 배열은 JSON 또는 콤마 구분 문자열, 객체는 JSON을 입력하면 됩니다."
+hint = "RP 전용 확장 claim을 구분해서 관리합니다. 사용자별 claim 값은 동의 및 Claims 탭에서 수정합니다."
 preview_hint = "저장될 metadata.id_token_claims 구조를 미리 확인할 수 있습니다."
 key_required = "Claim key를 입력해야 합니다."
 reserved_key = "`rp_claims`는 예약된 namespace 키입니다."
 duplicate_key = "중복된 claim key가 있습니다: {{namespace}}.{{key}}"
+invalid_default_value = "Claim 기본값이 타입과 맞지 않습니다: {{key}} ({{valueType}})"
 
 [msg.dev.clients.general.security]
 pkce_help = "PKCE 앱 (SPA/모바일): 브라우저나 앱처럼 비밀키를 보관하기 어려운 경우 사용하며, PKCE가 강제됩니다."
@@ -537,6 +545,7 @@ unavailable_with_reason = "RP 이용 통계 API 응답을 확인할 수 없습
 audit = "RP 설정 변경과 운영 이력을 확인합니다."
 clients = "등록된 RP를 조회하고 상태와 유형을 관리합니다."
 description = "주요 운영 화면으로 바로 이동합니다."
+developer_grants = "사용자에게 개발자 권한을 직접 부여하거나 회수합니다."
 developer_request = "개발자 권한 신청 내역을 확인하거나 새 요청을 등록합니다."
 new_client = "redirect URI, grant type, 인증 방식을 설정합니다."
 
@@ -548,6 +557,33 @@ none = "표시할 연동 앱이 없습니다."
 description = "변경 또는 삭제된 애플리케이션을 대시보드에서 추이를 확인합니다."
 empty = "최근 변경 로그가 아직 없습니다."
 
+[msg.dev.grants]
+approved = "승인됨"
+count = "총 {{count}}건"
+create_success = "개발자 권한을 직접 부여했습니다."
+description = "사용자에게 개발자 권한을 직접 부여하고, 부여된 권한을 회수합니다."
+admin_notes_hint = "회수는 목록의 회수 버튼으로 처리합니다."
+admin_notes_description = "직접 부여의 근거를 간단히 남겨 두면 추후 회수와 검토에 도움이 됩니다."
+admin_notes_placeholder = "예: 테스트 환경 확인 후 권한 부여"
+empty = "부여된 권한이 없습니다."
+forbidden = "개발자 권한 직접 부여는 super admin만 사용할 수 있습니다."
+forbidden_desc = "이 화면은 super admin만 사용할 수 있습니다."
+form.description = "사용자를 선택하면 현재 소속 테넌트, 이메일, 전화번호를 확인한 뒤 개발자 권한을 즉시 부여합니다."
+selected_info_description = "선택된 사용자의 소속, 이메일, 전화번호를 확인합니다."
+user_section_description = "검색어를 입력해 사용자를 선택합니다. 선택 전에는 다음 단계 정보가 비어 있습니다."
+list.description = "현재 부여된 개발자 권한 목록입니다."
+load_error = "개발자 권한 목록을 불러오지 못했습니다."
+reason = "부여 사유"
+revoke = "회수"
+revoke_success = "개발자 권한을 회수했습니다."
+search_empty = "검색 결과가 없습니다."
+search_loading = "사용자를 찾는 중입니다..."
+selected_user = "선택된 사용자: {{user}}"
+tenant_required = "선택한 사용자의 테넌트 정보를 확인할 수 없습니다."
+tenant_missing = "선택한 사용자의 테넌트 정보를 확인할 수 없습니다."
+user_required = "부여할 사용자를 선택해주세요."
+phone_missing = "등록된 전화번호가 없습니다."
+
 [msg.dev.dashboard.notice]
 consent_audit = "Consent 회수는 감사 로그와 연계"
 dev_scope = "RP 정책은 dev scope에서만 적용"
@@ -1001,11 +1037,8 @@ total_tenants = "전체 테넌트 수"
 manageable_tenants = "관리 가능한 테넌트"
 
 [ui.admin.role]
-rp_admin = "서비스 관리자 (RP Admin)"
 super_admin = "시스템 관리자 (Super Admin)"
-tenant_admin = "테넌트 관리자 (Tenant Admin)"
-tenant_member = "일반 사용자 (Tenant Member)"
-user = "일반 사용자 (Tenant Member)"
+user = "일반 사용자"
 
 [ui.admin.tenants]
 add = "테넌트 추가"
@@ -1291,6 +1324,7 @@ scope_badge = "Scoped to /dev"
 audit_logs = "감사 로그"
 clients = "연동 앱"
 developer_request = "개발자 권한 신청"
+developer_grants = "개발자 권한 부여"
 logout = "로그아웃"
 overview = "개요"
 
@@ -1306,10 +1340,35 @@ cancel_notes_placeholder = "승인 취소 사유 입력..."
 [ui.dev.request.list]
 title = "신청 내역"
 
+[ui.dev.grants]
+actions = "관리"
+admin_notes = "부여 사유"
+all_tenants = "전체 테넌트"
+approved = "승인됨"
+date = "부여일"
+form.title = "직접 부여"
+grant = "직접 부여"
+input_section = "입력"
+list.title = "부여된 권한"
+pages = "권한 페이지"
+read_only = "읽기 전용"
+reason = "부여 사유"
+reason_placeholder = "예: 운영 지원을 위해 개발 콘솔 접근이 필요합니다."
+required = "필수"
+selected_info = "선택된 사용자 정보"
+revoke = "회수"
+revoke_notes_placeholder = "회수 메모 (선택)..."
+status = "상태"
+tenant = "소속"
+user_section = "사용자 선택"
+user = "사용자"
+user_search_placeholder = "이름 또는 이메일 검색..."
+
 [ui.dev.request.modal]
 email = "이메일"
 name = "성함"
 org = "소속"
+pages = "권한 페이지"
 phone = "전화번호"
 reason = "신청 사유"
 reason_placeholder = "예: 자체 서비스 연동 및 테스트용 OIDC 클라이언트 생성이 필요합니다."
@@ -1327,6 +1386,7 @@ actions = "관리"
 date = "신청일"
 org = "소속"
 reason = "신청 사유"
+pages = "권한 페이지"
 status = "상태"
 user = "사용자"
 
@@ -1366,15 +1426,13 @@ collapse = "사이드바 접기"
 expand = "사이드바 펼치기"
 
 [ui.shell.role]
-rp_admin = "서비스 관리자 (RP Admin)"
 super_admin = "시스템 관리자 (Super Admin)"
-tenant_admin = "테넌트 관리자 (Tenant Admin)"
-user = "일반 사용자 (Tenant Member)"
+user = "일반 사용자"
 
 [ui.dev.clients]
 new = "연동 앱 추가"
 search_placeholder = "연동 앱 이름/ID로 검색..."
-tenant_scoped = "Tenant-scoped"
+tenant_limited = "Tenant-limited"
 untitled = "Untitled"
 
 [ui.dev.clients.recent_changes]
@@ -1479,10 +1537,10 @@ title = "보안 메모"
 
 [ui.dev.clients.details.tab]
 connection = "연동 설정"
-consents = "동의 및 사용자"
+consents = "동의 및 Claims"
 settings = "설정"
 relationships = "관계"
-user_claims = "사용자 Claim"
+user_claims = "Consents & Claims"
 
 [ui.dev.clients.general]
 create = "앱 생성"
@@ -1559,14 +1617,26 @@ preview_title = "저장 JSON 미리보기"
 namespace_label = "Claim 네임스페이스"
 namespace_top_level = "top-level"
 namespace_rp_claims = "rp_claims"
+nullable_label = "Nullable"
+read_user_allowed_label = "사용자 읽기 허용"
+write_user_allowed_label = "사용자 쓰기 허용"
+table.key = "Claim Key"
+table.namespace = "Namespace"
+table.value_type = "Value Type"
+table.nullable = "Nullable"
+table.read_user_allowed = "사용자 읽기"
+table.write_user_allowed = "사용자 쓰기"
+table.default_value = "기본값"
+table.delete = "삭제"
 value_type_label = "Claim 값 타입"
 value_type_text = "텍스트"
 value_type_number = "숫자"
+value_type_float = "실수"
 value_type_boolean = "불리언"
 value_type_array = "배열"
 value_type_object = "객체"
 key_placeholder = "예: locale"
-value_placeholder = "Claim 값을 입력하세요"
+value_placeholder = "기본값을 입력하세요"
 
 [ui.dev.clients.general.security]
 private = "Server side App"
@@ -2051,10 +2121,7 @@ title = "시스템 역할"
 description = "현재 계정에 부여된 권한 등급입니다."
 current = "현재 역할"
 desc_super_admin = "전체 시스템의 모든 테넌트와 모든 앱을 제한 없이 관리할 수 있습니다."
-desc_tenant_admin = "본인이 속한 테넌트(조직/회사) 하위의 모든 앱을 관리할 수 있습니다."
-desc_rp_admin = "본인에게 할당된 연동 앱(Client)만 확인 및 관리할 수 있습니다."
 desc_user = "기본 앱 이용 권한을 가지며, DevFront 접근은 차단됩니다."
-desc_tenant_member = "기본 앱 이용 권한을 가지며, DevFront 접근은 차단됩니다."
 
 [ui.dev.tenant]
 workspace = "작업 테넌트 (컨텍스트)"
@@ -2064,9 +2131,10 @@ single_notice = "단일 테넌트에 소속되어 전환할 필요가 없습니
 
 [msg.dev.forbidden]
 default = "해당 리소스에 접근할 권한이 없습니다. 관리자에게 문의하세요."
-rp_admin = "RP 관리자는 담당 앱의 리소스만 조회할 수 있습니다."
-tenant_admin = "테넌트 관리자 권한이 올바르게 설정되지 않았거나 만료되었습니다."
 user.clients = "일반 사용자 계정은 담당 RP(앱)에 대한 운영 또는 관리 관계가 부여된 경우에만 해당 기능을 사용할 수 있습니다. 권한이 필요하면 관리자에게 요청하세요."
-user.consents = "해당 앱(RP)에 대한 동의 내역 조회는 'RP 관리자', '동의 조회', '동의 회수' 관계가 부여된 경우에만 사용할 수 있습니다. 권한이 필요하면 관리자에게 요청하세요."
-user.audit = "해당 앱(RP)에 대한 감사 로그 조회는 'RP 관리자', '감사 조회' 관계가 부여된 경우에만 사용할 수 있습니다. 권한이 필요하면 관리자에게 요청하세요."
+user.consents = "해당 앱(RP)에 대한 동의 내역 조회는 운영, 동의 조회, 동의 회수 관계가 부여된 경우에만 사용할 수 있습니다. 권한이 필요하면 관리자에게 요청하세요."
+user.audit = "해당 앱(RP)에 대한 감사 로그 조회는 운영 또는 감사 조회 관계가 부여된 경우에만 사용할 수 있습니다. 권한이 필요하면 관리자에게 요청하세요."
 title = "{{resource}} 접근 권한 없음"
+
+[ui.common]
+na = "없음"

devfront/src/locales/template.toml

@@ -343,6 +343,8 @@ user_desc = ""
 
 [msg.dev.request.modal]
 desc = ""
+tenant_required = ""
+tenant_required_detail = ""
 
 [msg.dev.request.status]
 approved = ""
@@ -379,6 +381,8 @@ empty = ""
 empty_detail = ""
 empty_can_create = ""
 empty_can_create_detail = ""
+create_requires_tenant = ""
+create_requires_tenant_detail = ""
 create_requires_request = ""
 create_pending_detail = ""
 create_forbidden_detail = ""
@@ -386,6 +390,8 @@ empty_filtered = ""
 empty_filtered_detail = ""
 empty_pending = ""
 empty_pending_detail = ""
+empty_tenant_missing = ""
+empty_tenant_missing_detail = ""
 
 [msg.dev.clients.consents]
 empty = ""
@@ -439,6 +445,7 @@ preview_hint = ""
 key_required = ""
 reserved_key = ""
 duplicate_key = ""
+invalid_default_value = ""
 
 [msg.dev.clients.relationships]
 subtitle = ""
@@ -575,6 +582,7 @@ unavailable_with_reason = ""
 audit = ""
 clients = ""
 description = ""
+developer_grants = ""
 developer_request = ""
 new_client = ""
 
@@ -586,6 +594,34 @@ none = ""
 description = ""
 empty = ""
 
+[msg.dev.grants]
+approved = ""
+count = ""
+create_success = ""
+description = ""
+admin_notes_hint = ""
+admin_notes_description = ""
+admin_notes_placeholder = ""
+empty = ""
+forbidden = ""
+forbidden_desc = ""
+form.description = ""
+selected_info_description = ""
+user_section_description = ""
+list.description = ""
+load_error = ""
+reason = ""
+revoke = ""
+revoke_success = ""
+search_empty = ""
+search_loading = ""
+selected_user = ""
+tenant_required = ""
+tenant_missing = ""
+user_required = ""
+phone_missing = ""
+required = ""
+
 [msg.dev.dashboard.notice]
 consent_audit = ""
 dev_scope = ""
@@ -1040,10 +1076,7 @@ total_tenants = ""
 manageable_tenants = ""
 
 [ui.admin.role]
-rp_admin = ""
 super_admin = ""
-tenant_admin = ""
-tenant_member = ""
 user = ""
 
 [ui.admin.tenants]
@@ -1344,6 +1377,7 @@ scope_badge = ""
 audit_logs = ""
 clients = ""
 developer_request = ""
+developer_grants = ""
 logout = ""
 overview = ""
 
@@ -1358,6 +1392,29 @@ cancel_notes_placeholder = ""
 [ui.dev.request.list]
 title = ""
 
+[ui.dev.grants]
+actions = ""
+admin_notes = ""
+all_tenants = ""
+approved = ""
+date = ""
+form.title = ""
+grant = ""
+input_section = ""
+list.title = ""
+read_only = ""
+reason = ""
+reason_placeholder = ""
+required = ""
+selected_info = ""
+revoke = ""
+revoke_notes_placeholder = ""
+status = ""
+tenant = ""
+user_section = ""
+user = ""
+user_search_placeholder = ""
+
 [ui.dev.request.modal]
 email = ""
 name = ""
@@ -1422,15 +1479,13 @@ collapse = ""
 expand = ""
 
 [ui.shell.role]
-rp_admin = ""
 super_admin = ""
-tenant_admin = ""
 user = ""
 
 [ui.dev.clients]
 new = ""
 search_placeholder = ""
-tenant_scoped = ""
+tenant_limited = ""
 untitled = ""
 
 [ui.dev.clients.recent_changes]
@@ -1611,9 +1666,21 @@ preview_title = ""
 namespace_label = ""
 namespace_top_level = ""
 namespace_rp_claims = ""
+nullable_label = ""
+read_user_allowed_label = ""
+write_user_allowed_label = ""
+table.key = ""
+table.namespace = ""
+table.value_type = ""
+table.nullable = ""
+table.read_user_allowed = ""
+table.write_user_allowed = ""
+table.default_value = ""
+table.delete = ""
 value_type_label = ""
 value_type_text = ""
 value_type_number = ""
+value_type_float = ""
 value_type_boolean = ""
 value_type_array = ""
 value_type_object = ""
@@ -2093,10 +2160,7 @@ title = ""
 description = ""
 current = ""
 desc_super_admin = ""
-desc_tenant_admin = ""
-desc_rp_admin = ""
 desc_user = ""
-desc_tenant_member = ""
 
 [ui.dev.tenant]
 workspace = "Workspace Tenant (Context)"

devfront/tests/clients.spec.ts

@@ -50,6 +50,43 @@ test("clients page loads correctly", async ({ page }) => {
   ).toBeVisible();
 });
 
+test("clients page shows Tenant-limited only for tenant access restricted RP", async ({
+  page,
+}) => {
+  await seedAuth(page, "super_admin");
+  await installDevApiMock(page, {
+    clients: [
+      makeClient("client-limited", {
+        name: "Limited RP",
+        createdAt: "2026-05-02T00:00:00.000Z",
+        metadata: {
+          tenant_access_restricted: true,
+          allowed_tenants: ["tenant-1"],
+        },
+      }),
+      makeClient("client-open", {
+        name: "Open RP",
+        createdAt: "2026-05-01T00:00:00.000Z",
+        metadata: {
+          tenant_access_restricted: false,
+          allowed_tenants: [],
+        },
+      }),
+    ],
+    consents: [] as Consent[],
+    auditLogsByCursor: undefined,
+  });
+
+  await page.goto("/clients");
+
+  const limitedRow = page.locator("tbody tr", { hasText: "Limited RP" });
+  await expect(limitedRow).toContainText("Tenant-limited");
+
+  const openRow = page.locator("tbody tr", { hasText: "Open RP" });
+  await expect(openRow).not.toContainText("Tenant-limited");
+  await expect(page.getByText("Tenant-scoped")).toHaveCount(0);
+});
+
 test("overview page shows recent RP changes", async ({ page }) => {
   await seedAuth(page, "super_admin");
   await installDevApiMock(page, {

devfront/tests/devfront-client-claims-cache.spec.ts

@@ -0,0 +1,371 @@
+import { expect, test } from "@playwright/test";
+import {
+  type ClientRelation,
+  type Consent,
+  installDevApiMock,
+  makeClient,
+  seedAuth,
+} from "./helpers/devfront-fixtures";
+import { installDevFrontStaticRoutes } from "./helpers/static-devfront";
+
+const editRelations = [
+  {
+    relation: "config_editor",
+    subject: "User:playwright-user",
+    subjectType: "User",
+    subjectId: "playwright-user",
+  },
+  {
+    relation: "admins",
+    subject: "User:playwright-user",
+    subjectType: "User",
+    subjectId: "playwright-user",
+  },
+  {
+    relation: "config_editor",
+    subject: "User:admin-user",
+    subjectType: "User",
+    subjectId: "admin-user",
+  },
+  {
+    relation: "config_editor",
+    subject: "User:undefined",
+    subjectType: "User",
+    subjectId: "undefined",
+  },
+  {
+    relation: "config_editor",
+    subject: "User:",
+    subjectType: "User",
+    subjectId: "",
+  },
+] satisfies ClientRelation[];
+
+test.describe("DevFront RP claim cache", () => {
+  test.beforeEach(async ({ page }) => {
+    await installDevFrontStaticRoutes(page);
+    await seedAuth(page, "super_admin");
+  });
+
+  test("keeps saved RP claim value visible after saving", async ({ page }) => {
+    const state = {
+      clients: [
+        makeClient("client-claims", {
+          name: "Claims app",
+          metadata: {
+            id_token_claims: [
+              {
+                namespace: "rp_claims",
+                key: "old_claim",
+                value: "A",
+                valueType: "text",
+                readPermission: "admin_only",
+                writePermission: "admin_only",
+              },
+            ],
+          },
+        }),
+      ],
+      consents: [] as Consent[],
+      relations: {
+        "client-claims": editRelations,
+      },
+      auditLogsByCursor: undefined,
+      mockRole: "super_admin",
+    };
+    await installDevApiMock(page, state);
+
+    await page.goto("http://devfront.test/clients/client-claims/settings");
+
+    const claimKeyInput = page
+      .getByPlaceholder(/e\.g\. locale|예: locale/i)
+      .first();
+    await expect(claimKeyInput).toHaveValue("old_claim");
+    await expect(claimKeyInput).toBeEnabled();
+
+    await claimKeyInput.fill("new_claim");
+    await page.getByRole("button", { name: /^저장$|^Save$/i }).click();
+
+    await expect
+      .poll(
+        () =>
+          (
+            state.clients[0]?.metadata?.id_token_claims as
+              | Array<{ key?: string }>
+              | undefined
+          )?.[0]?.key,
+      )
+      .toBe("new_claim");
+    await expect(claimKeyInput).toHaveValue("new_claim");
+  });
+
+  test("adds supported scopes and custom claim keys from the scope picker including offline_access", async ({
+    page,
+  }) => {
+    const state = {
+      clients: [
+        makeClient("client-claims", {
+          name: "Claims app",
+          metadata: {
+            structured_scopes: [
+              {
+                id: "scope-openid",
+                name: "openid",
+                description: "OIDC",
+                mandatory: true,
+              },
+            ],
+            id_token_claims: [
+              {
+                namespace: "rp_claims",
+                key: "employee_code",
+                value: "E001",
+                valueType: "text",
+                readPermission: "admin_only",
+                writePermission: "admin_only",
+              },
+            ],
+          },
+        }),
+      ],
+      consents: [] as Consent[],
+      relations: {
+        "client-claims": editRelations,
+      },
+      auditLogsByCursor: undefined,
+      mockRole: "super_admin",
+    };
+    await installDevApiMock(page, state);
+
+    await page.goto("http://devfront.test/clients/client-claims/settings");
+    await page
+      .getByRole("button", { name: /스코프 추가|Scope 추가|Add Scope/i })
+      .click();
+
+    await expect(
+      page.getByText("offline_access", { exact: true }),
+    ).toBeVisible();
+    await expect(
+      page.getByRole("button", { name: /employee_code/ }),
+    ).toBeVisible();
+
+    await page.getByRole("button", { name: /employee_code/ }).click();
+    await page.getByRole("button", { name: /^저장$|^Save$/i }).click();
+
+    await expect
+      .poll(() =>
+        (
+          state.clients[0]?.metadata?.structured_scopes as
+            | Array<{ name?: string }>
+            | undefined
+        )?.some((scope) => scope.name === "employee_code"),
+      )
+      .toBe(true);
+  });
+
+  test("forces read permission on when write permission is enabled", async ({
+    page,
+  }) => {
+    const state = {
+      clients: [
+        makeClient("client-claims", {
+          name: "Claims app",
+          metadata: {
+            id_token_claims: [
+              {
+                namespace: "rp_claims",
+                key: "locale",
+                value: "ko",
+                valueType: "text",
+                readPermission: "admin_only",
+                writePermission: "admin_only",
+              },
+            ],
+          },
+        }),
+      ],
+      consents: [] as Consent[],
+      relations: {
+        "client-claims": editRelations,
+      },
+      auditLogsByCursor: undefined,
+      mockRole: "super_admin",
+    };
+    await installDevApiMock(page, state);
+
+    await page.goto("http://devfront.test/clients/client-claims/settings");
+
+    const readSwitch = page
+      .getByRole("switch", { name: /사용자 읽기|Allow user read/i })
+      .first();
+    const writeSwitch = page
+      .getByRole("switch", { name: /사용자 쓰기|Allow user write/i })
+      .first();
+
+    await expect(readSwitch).toHaveAttribute("aria-checked", "false");
+    await expect(writeSwitch).toHaveAttribute("aria-checked", "false");
+    await expect(readSwitch).toBeEnabled();
+    await expect(writeSwitch).toBeEnabled();
+
+    await writeSwitch.click();
+
+    await expect(readSwitch).toHaveAttribute("aria-checked", "true");
+    await expect(writeSwitch).toHaveAttribute("aria-checked", "true");
+
+    await page.getByRole("button", { name: /^저장$|^Save$/i }).click();
+
+    await expect
+      .poll(
+        () =>
+          (
+            state.clients[0]?.metadata?.id_token_claims as
+              | Array<{
+                  readPermission?: string;
+                  writePermission?: string;
+                }>
+              | undefined
+          )?.[0],
+      )
+      .toMatchObject({
+        readPermission: "user_and_admin",
+        writePermission: "user_and_admin",
+      });
+  });
+
+  test("blocks saving an RP claim default value that does not match the selected value type", async ({
+    page,
+  }) => {
+    const state = {
+      clients: [
+        makeClient("client-claims", {
+          name: "Claims app",
+          metadata: {
+            id_token_claims: [
+              {
+                namespace: "rp_claims",
+                key: "profile",
+                value: "{}",
+                valueType: "text",
+                readPermission: "admin_only",
+                writePermission: "admin_only",
+              },
+            ],
+          },
+        }),
+      ],
+      consents: [] as Consent[],
+      relations: {
+        "client-claims": editRelations,
+      },
+      auditLogsByCursor: undefined,
+      mockRole: "super_admin",
+    };
+    await installDevApiMock(page, state);
+
+    await page.goto("http://devfront.test/clients/client-claims/settings");
+
+    await page
+      .getByLabel(/Claim 값 타입|Claim value type/i)
+      .first()
+      .selectOption("object");
+    await page
+      .locator('textarea[placeholder="{\\"key\\": \\"value\\"}"]')
+      .fill("not-json");
+
+    await expect(
+      page.getByRole("button", { name: /^저장$|^Save$/i }),
+    ).toBeDisabled();
+
+    expect(
+      (
+        state.clients[0]?.metadata?.id_token_claims as
+          | Array<{ valueType?: string; value?: string }>
+          | undefined
+      )?.[0],
+    ).toMatchObject({
+      value: "{}",
+      valueType: "text",
+    });
+  });
+
+  test("saves a float RP claim default value and blocks decimal values for integer number claims", async ({
+    page,
+  }) => {
+    const state = {
+      clients: [
+        makeClient("client-claims", {
+          name: "Claims app",
+          metadata: {
+            id_token_claims: [
+              {
+                namespace: "rp_claims",
+                key: "ratio",
+                value: "0",
+                valueType: "text",
+                readPermission: "admin_only",
+                writePermission: "admin_only",
+              },
+            ],
+          },
+        }),
+      ],
+      consents: [] as Consent[],
+      relations: {
+        "client-claims": editRelations,
+      },
+      auditLogsByCursor: undefined,
+      mockRole: "super_admin",
+    };
+    await installDevApiMock(page, state);
+
+    await page.goto("http://devfront.test/clients/client-claims/settings");
+
+    await page
+      .getByLabel(/Claim 값 타입|Claim value type/i)
+      .first()
+      .selectOption("float");
+    await page
+      .getByPlaceholder(/기본값을 입력하세요|Enter the default value/i)
+      .first()
+      .fill("3.14");
+    await page.getByRole("button", { name: /^저장$|^Save$/i }).click();
+
+    await expect
+      .poll(
+        () =>
+          (
+            state.clients[0]?.metadata?.id_token_claims as
+              | Array<{ valueType?: string; value?: string }>
+              | undefined
+          )?.[0],
+      )
+      .toMatchObject({
+        value: "3.14",
+        valueType: "float",
+      });
+
+    const valueTypeSelect = page
+      .getByLabel(/Claim 값 타입|Claim value type/i)
+      .first();
+    await expect(valueTypeSelect).toHaveValue("float");
+    await expect(
+      page.getByRole("button", { name: /^저장$|^Save$/i }),
+    ).toBeEnabled();
+
+    await valueTypeSelect.selectOption("number");
+    await expect(valueTypeSelect).toHaveValue("number");
+    const defaultValueInput = page
+      .getByPlaceholder(/기본값을 입력하세요|Enter the default value/i)
+      .first();
+    await expect(defaultValueInput).toHaveAttribute("inputmode", "numeric");
+    await expect(defaultValueInput).toHaveAttribute("pattern", "-?[0-9]*");
+    await defaultValueInput.fill("3.14");
+
+    await expect(
+      page.getByText(/Claim 기본값이 타입과 맞지 않습니다|does not match/i),
+    ).toBeVisible();
+    await expect(
+      page.getByRole("button", { name: /^저장$|^Save$/i }),
+    ).toBeDisabled();
+  });
+});

devfront/tests/devfront-client-tabs.spec.ts

@@ -6,6 +6,7 @@ import {
   makeClient,
   seedAuth,
 } from "./helpers/devfront-fixtures";
+import { installDevFrontStaticRoutes } from "./helpers/static-devfront";
 
 function expectClientTabsOrder(pagePath: string, expectedActive: RegExp) {
   return async ({ page }: { page: Page }) => {
@@ -24,9 +25,10 @@ function expectClientTabsOrder(pagePath: string, expectedActive: RegExp) {
       },
       auditLogsByCursor: undefined,
     };
+    await installDevFrontStaticRoutes(page);
     await installDevApiMock(page, state);
 
-    await page.goto(pagePath);
+    await page.goto(`http://devfront.test${pagePath}`);
 
     const header = page
       .locator("header")
@@ -38,7 +40,7 @@ function expectClientTabsOrder(pagePath: string, expectedActive: RegExp) {
 
     await expect(tabs).toHaveText([
       "연동 설정",
-      "사용자 Claim",
+      "동의 및 Claims",
       "설정",
       "관계",
     ]);
@@ -53,7 +55,7 @@ function expectClientTabsOrder(pagePath: string, expectedActive: RegExp) {
 
 test.describe("DevFront client detail tabs", () => {
   test.beforeEach(async ({ page }) => {
-    await seedAuth(page, "rp_admin");
+    await seedAuth(page, "super_admin");
   });
 
   test(

devfront/tests/devfront-clients-lifecycle.spec.ts

@@ -155,14 +155,23 @@ test.describe("DevFront clients lifecycle", () => {
       .getByLabel(/Claim value type|Claim 값 타입/i)
       .first()
       .selectOption("date");
+    await expect(
+      page.getByRole("columnheader", { name: /Default Value|기본값/i }),
+    ).toBeVisible();
     await page
-      .getByPlaceholder(/Claim 값을 입력하세요|Enter the claim value/i)
+      .getByPlaceholder(/기본값을 입력하세요|Enter the default value/i)
       .first()
       .fill("2026-06-09");
     await page
-      .getByLabel(/읽기 권한|Read permission/i)
+      .getByLabel(/Nullable|Null 허용/i)
       .first()
-      .selectOption("user_and_admin");
+      .click();
+    await page
+      .getByLabel(
+        /Read 사용자 허용|Read user allowed|사용자 읽기 허용|Allow user read/i,
+      )
+      .first()
+      .click();
 
     await page.getByRole("button", { name: /Claim 추가|Add Claim/i }).click();
     await page
@@ -174,7 +183,7 @@ test.describe("DevFront clients lifecycle", () => {
       .nth(1)
       .selectOption("number");
     await page
-      .getByPlaceholder(/Claim 값을 입력하세요|Enter the claim value/i)
+      .getByPlaceholder(/기본값을 입력하세요|Enter the default value/i)
       .nth(1)
       .fill("2");
 
@@ -238,6 +247,7 @@ test.describe("DevFront clients lifecycle", () => {
                   key?: string;
                   value?: string;
                   valueType?: string;
+                  nullable?: boolean;
                   readPermission?: string;
                   writePermission?: string;
                 }>
@@ -245,6 +255,18 @@ test.describe("DevFront clients lifecycle", () => {
           )?.[0]?.valueType,
       )
       .toBe("date");
+    await expect
+      .poll(
+        () =>
+          (
+            state.clients[0]?.metadata?.id_token_claims as
+              | Array<{
+                  nullable?: boolean;
+                }>
+              | undefined
+          )?.[0]?.nullable,
+      )
+      .toBe(true);
     await expect
       .poll(
         () =>
@@ -313,18 +335,33 @@ test.describe("DevFront clients lifecycle", () => {
       page.getByPlaceholder(/e\.g\. locale|예: locale/i).nth(1),
     ).toHaveValue("tier");
     await expect(
-      page.getByPlaceholder(/Claim 값을 입력하세요|Enter the claim value/i),
+      page.getByPlaceholder(/기본값을 입력하세요|Enter the default value/i),
     ).toHaveCount(2);
     await expect(
       page
-        .getByPlaceholder(/Claim 값을 입력하세요|Enter the claim value/i)
+        .getByPlaceholder(/기본값을 입력하세요|Enter the default value/i)
         .first(),
     ).toHaveValue("2026-06-09");
     await expect(
       page
-        .getByPlaceholder(/Claim 값을 입력하세요|Enter the claim value/i)
+        .getByPlaceholder(/기본값을 입력하세요|Enter the default value/i)
         .nth(1),
     ).toHaveValue("2");
+    await expect(page.getByLabel(/Nullable|Null 허용/i).first()).toBeChecked();
+    await expect(
+      page
+        .getByLabel(
+          /Read 사용자 허용|Read user allowed|사용자 읽기 허용|Allow user read/i,
+        )
+        .first(),
+    ).toBeChecked();
+    await expect(
+      page
+        .getByLabel(
+          /Write 사용자 허용|Write user allowed|사용자 쓰기 허용|Allow user write/i,
+        )
+        .first(),
+    ).not.toBeChecked();
   });
 
   test("headless login uses jwks uri only and shows cache actions", async ({

devfront/tests/devfront-consents.spec.ts

@@ -6,6 +6,8 @@ import {
   seedAuth,
 } from "./helpers/devfront-fixtures";
 import { captureEvidence } from "./helpers/evidence";
+import { installDevFrontStaticRoutes } from "./helpers/static-devfront";
+import { dateTimeInputToUnixSeconds } from "../src/features/clients/rpClaimDateTime";
 
 test.describe("DevFront consents", () => {
   test.afterEach(async ({ page }, testInfo) => {
@@ -15,6 +17,7 @@ test.describe("DevFront consents", () => {
   });
 
   test.beforeEach(async ({ page }) => {
+    await installDevFrontStaticRoutes(page);
     page.on("dialog", async (dialog) => {
       await dialog.accept();
     });
@@ -40,6 +43,18 @@ test.describe("DevFront consents", () => {
                 valueType: "datetime",
                 value: "2026-06-09T09:30",
               },
+              {
+                namespace: "rp_claims",
+                key: "active_member",
+                valueType: "boolean",
+                value: "true",
+              },
+              {
+                namespace: "rp_claims",
+                key: "score",
+                valueType: "number",
+                value: "1",
+              },
             ],
           },
         }),
@@ -69,7 +84,7 @@ test.describe("DevFront consents", () => {
     };
     await installDevApiMock(page, state);
 
-    await page.goto("/clients/client-consent/consents");
+    await page.goto("http://devfront.test/clients/client-consent/consents");
     await expect(page.getByText("Alice")).toBeVisible();
     await expect(page.getByText("Tenant A")).toBeVisible();
     await expect(page.getByText(/approvalLevel:\s*A/)).toBeVisible();
@@ -78,20 +93,41 @@ test.describe("DevFront consents", () => {
     await expect(page.getByText("RP Custom Claims")).toBeVisible();
     await expect(page.getByText("contract_date")).toBeVisible();
     await expect(page.getByText("approved_at")).toBeVisible();
+    await expect(page.getByText("active_member")).toBeVisible();
     await expect(page.locator('input[type="date"]')).toHaveValue("2026-06-09");
+    await expect(
+      page.getByLabel(/contract_date.*timezone|timezone.*contract_date/i),
+    ).toHaveValue(
+      await page.evaluate(
+        () => Intl.DateTimeFormat().resolvedOptions().timeZone,
+      ),
+    );
     await page.locator('input[type="date"]').fill("2026-06-10");
     await page.locator('input[type="datetime-local"]').fill("2026-06-09T10:30");
     await page
-      .getByLabel(/쓰기 권한|Write permission/i)
-      .first()
-      .selectOption("user_and_admin");
+      .getByLabel(/active_member.*boolean|boolean.*active_member/i)
+      .selectOption("false");
+    await page.getByLabel(/score.*number|number.*score/i).fill("42");
     await page.getByRole("button", { name: /Claim 저장|Save Claim/i }).click();
+    const browserTimeZone = await page.evaluate(
+      () => Intl.DateTimeFormat().resolvedOptions().timeZone,
+    );
     await expect
       .poll(() => state.consents[0]?.rpMetadata?.contract_date)
-      .toBe("2026-06-10");
+      .toBe(dateTimeInputToUnixSeconds("2026-06-10", "date", browserTimeZone));
     await expect
       .poll(() => state.consents[0]?.rpMetadata?.approved_at)
-      .toBe("2026-06-09T10:30");
+      .toBe(
+        dateTimeInputToUnixSeconds(
+          "2026-06-09T10:30",
+          "datetime",
+          browserTimeZone,
+        ),
+      );
+    await expect
+      .poll(() => state.consents[0]?.rpMetadata?.active_member)
+      .toBe(false);
+    await expect.poll(() => state.consents[0]?.rpMetadata?.score).toBe(42);
     await expect
       .poll(
         () =>
@@ -101,9 +137,48 @@ test.describe("DevFront consents", () => {
               | undefined
           )?.writePermission,
       )
-      .toBe("user_and_admin");
+      .toBe("admin_only");
 
     await page.getByRole("button", { name: /권한 철회|철회|Revoke/i }).click();
     await expect(page.getByText(/Revoked|철회/i).first()).toBeVisible();
   });
+
+  test("does not allow adding undefined RP claims from consents and claims", async ({
+    page,
+  }) => {
+    const state = {
+      clients: [
+        makeClient("client-consent", {
+          name: "Consent app",
+          metadata: {},
+        }),
+      ],
+      consents: [
+        {
+          subject: "user-1",
+          userName: "Alice",
+          clientId: "client-consent",
+          clientName: "Consent app",
+          grantedScopes: ["openid", "profile"],
+          authenticatedAt: "2026-03-03T08:00:00.000Z",
+          createdAt: "2026-03-02T08:00:00.000Z",
+          status: "active",
+          tenantId: "tenant-a",
+          tenantName: "Tenant A",
+          rpMetadata: {},
+        },
+      ] as Consent[],
+      auditLogsByCursor: undefined,
+    };
+    await installDevApiMock(page, state);
+
+    await page.goto("http://devfront.test/clients/client-consent/consents");
+    await page.getByRole("button", { name: /Claims|Claim/i }).click();
+
+    await expect(page.getByText("RP Custom Claims")).toBeVisible();
+    await expect(
+      page.getByRole("button", { name: /^추가$|^Add$/ }),
+    ).toHaveCount(0);
+    await expect(page.getByPlaceholder(/claim_key/i)).toHaveCount(0);
+  });
 });