Decorator decorations are unsound until you augment. @Roles('owner', 'admin') looks like it is type-checked — it is not, until you tell TypeScript what AuthUser['roles'] actually is. ctx.get('tenant') looks like it returns a tenant — it does not, until you tell ContextMeta that 'tenant' is a key. @Can('delete', 'invoice') looks like a permission check — but until PolicyRegistry knows about 'invoice' , both arguments are just string . KickJS v5 ships these three interfaces deliberately empty so each adopter can fill them in, and the framework's helper types pivot on whether you have.…