docs(access): describe acting context enforcement

src/govoplan_access/backend/manifest.py

@@ -636,6 +636,7 @@ ACCESS_DOCUMENTATION: tuple[DocumentationTopic, ...] = (
             "Organizations owns the organization meta-model, concrete units, structures, and functions. IDM owns the fact that an identity, through one of its accounts, holds a function in an organization unit, including delegated and acting-for assignments. "
             "Access consumes those accepted IDM facts through the directory capability, validates function identifiers against Organizations, and turns them into rights only when an explicit external function role mapping connects the organization function ID to an assignable tenant role. "
             "The assignment itself does not grant rights. Removing the IDM assignment, disabling the Organizations function, or removing the Access mapping stops the derived role source from contributing effective permissions. "
+            "A delegated assignment contributes under the delegate's own account. An acting-for assignment contributes only after an interactive session selects that exact current assignment; Access retains both the real and represented account, audits context changes, and rejects stale or mismatched selections. "
             "Tenant administrators inspect this from the user access explanation dialog: role sources link back to the Organizations function or unit that defines the fact and to the IDM assignment that produced it. "
             "The same explanation is exposed by the admin API, while mapping management remains under Admin > Function role mappings. This keeps the audit trail clear: Organizations records what can exist, IDM records who holds it, and Access records which accepted facts produce permissions."
         ),
@@ -655,6 +656,7 @@ ACCESS_DOCUMENTATION: tuple[DocumentationTopic, ...] = (
             DocumentationLink(label="Effective user access explanation API", href="/api/v1/admin/users/{user_id}/access-explanation", kind="api"),
             DocumentationLink(label="Organizations functions", href="/organizations?section=functions", kind="runtime"),
             DocumentationLink(label="IDM assignments", href="/idm", kind="runtime"),
+            DocumentationLink(label="Acting contexts API", href="/api/v1/auth/acting-contexts", kind="api"),
         ),
         metadata={
             "kind": "reference",
@@ -666,6 +668,7 @@ ACCESS_DOCUMENTATION: tuple[DocumentationTopic, ...] = (
             "api_path": "/api/v1/admin/external-function-role-mappings",
             "explanation_api_path": "/api/v1/admin/users/{user_id}/access-explanation",
             "runtime_routes": ["/admin?section=tenant-function-role-mappings", "/organizations?section=functions", "/idm"],
+            "acting_context_api_paths": ["/api/v1/auth/acting-contexts", "/api/v1/auth/switch-acting-context"],
             "permission_scopes": ["access:function:write", "access:role:assign"],
             "responsibility_boundaries": {
                 "organizations": "Defines organization units, structures, function types, and functions.",