PowerSchool title-based functional-role checkpoint

This controlled build extends the successful SAML-bound staff-facts and role-source proofs by reading native USERS.Title server-side for the cryptographically verified staff DCID.

SAML validation state: READY FOR TITLE-BASED FUNCTIONAL-ROLE PROOF

Titles are evaluated against an exact RCA allowlist only. Unknown, blank, case-variant, or keyword-only titles fail closed.

The browser cannot supply or override staff DCID, PowerSchool title, security group, role candidate, school affiliation, or scope.

No MTSS role or effective scope is granted. Teacher roster authorization, principal home-school scope, and authorization-grade governance of the Title field remain separate proofs.

No student read, PowerSchool write, facts persistence, or MTSS domain write is introduced.

Launch from the existing PowerSchool RCA MTSS - TEST ONLY link after the companion Integration Probe update is enabled.