SDD feedback on auth language

docs/overview/design/assets/c4-plandev-context.puml

@@ -9,12 +9,12 @@ System(missionScheduler, "Mission Scheduler", "The mission scheduling logic syst
 
 System(plandev, "PlanDev", "Provides mission activity and sequence simulation and resource analysis")
 
-System_Ext(cam, "Common Access Manager", "Central authentication and authorization provider")
+System_Ext(cam, "Common Access Manager", "Central authentication and identity data provider")
 
 Rel_D(missionTool, plandev, "Query data")
 Rel_D(planner, plandev, "Views and edits plans, resource profiles, constraints")
 Rel_D(missionScheduler, plandev, "Query resource profiles and constraints, mutate plans")
 
-Rel_D(plandev, cam, "Get authentication/authorization")
+Rel_D(plandev, cam, "Get authentication/identity data")
 
 @enduml

docs/overview/design/software-design-document.mdx

@@ -533,18 +533,23 @@ configuration file.
 
 ### Authentication and Authorization
 
-PlanDev provides authentication and authorization capabilities via the
-Common Access Manager. Currently, authentication requests from the
-PlanDev UI are proxied through the aerie-ui service. It is prudent that
-PlanDev not handle (proxy/store) any credential information, for any
-duration of time. As a result, PlanDev authentication will soon be
-amended so requests for an authentication token are made directly to a
-CAM server instance with the Cross-Origin Resource Sharing (CORS)
-capability enabled.
-
-Authorization is provided by configuring CAM policies. The PlanDev
-GraphQL API Server manages authorization of API access and limits
-access based on user roles per API field granularity.
+The PlanDev Gateway service handles user authentication through a
+modular JavaScript adapter interface. Authentication requests from the
+UI are proxied through the `plandev-ui` service to the Gateway.
+Deployments can provide custom authentication adapters to integrate
+PlanDev with external identity providers or use a built-in adapter.
+
+PlanDev currently includes one built-in adapter for integration with
+Common Access Manager (CAM). CAM is an external identity provider that
+is deployed and managed separately from PlanDev. The adapter authenticates
+users against a deployment's CAM service and retrieves identity data,
+including group membership.
+
+When the CAM adapter is used, a user-provided JSON configuration,
+supplied through an environment variable, maps CAM groups to PlanDev
+roles and permissions. PlanDev services use these roles and permissions
+to authorize access to protected resources. The PlanDev GraphQL API
+Server enforces authorization at field-level granularity.
 
 ### Data Model