테넌트 소유자, 관리자 분리

backend/internal/middleware/rbac.go

@@ -59,8 +59,8 @@ func RequireKetoPermission(config RBACConfig, namespace, relation string) fiber.
 			c.Locals("tenant_id", objectID)
 		}
 
-		// Check with Keto
-		allowed, err := config.KetoService.CheckPermission(c.Context(), profile.ID, namespace, objectID, relation)
+		// Check with Keto - add User: prefix to subject
+		allowed, err := config.KetoService.CheckPermission(c.Context(), "User:"+profile.ID, namespace, objectID, relation)
 		if err != nil {
 			slog.Error("Keto service error", "error", err, "userID", profile.ID, "objectID", objectID)
 			return errorJSON(c, fiber.StatusInternalServerError, "permission check error")