# Detailed route map

| Name pattern | URI | Audience |
|---|---|---|
| login, password.*, verification.* | `/login`, `/forgot-password`, `/verify-email` | guest/auth user |
| app.dashboard | `/app` | team |
| app.clients.*, app.projects.* | `/app/clients`, `/app/projects` | team |
| app.calendar, app.review-queue, app.team, app.invoices, app.activity, app.settings | `/app/*` | team (policy scoped) |
| portal.overview | `/portal` | client |
| portal.request, portal.projects, portal.files, portal.invoices, portal.profile, portal.account | `/portal/*` | client |
| invitations.accept | `/invitations/{token}` | guest, rate-limited |
| files.download | `/files/{file}/download` | authenticated + `download` policy |

Use named routes and route model binding only after a policy/workspace lookup. Do not create numerical public URLs for private resources.