export async function authorizeTicket(identity, ticket, directory) {
  // Directory failures propagate; callers must not turn them into permission.
  const session = await directory.session(identity.sessionId);
  if (!session?.active || session.subject !== identity.subject) return false;
  const user = await directory.user(identity.subject);
  if (!user?.active || !user.groups.includes("support")) return false;
  return user.customerIds.includes(ticket.customerId);
}