Every route is gated by PlatformOperatorGuard (the sole cross-platform authority, fail-closed).
These handlers act WITHOUT a tenant scope on purpose: suspending a platform user revokes their
access across every tenant and the platform layer (FR-10/FR-11), so they never bind TenantIsolationGuard.
suspend (active→suspended) additionally hard-invalidates the user's sessions (D4 · §159);
resume (suspended→active) lifts the deny-list. Each success/failure emits a structured audit line (FR-6).
平台操作员用户治理切片的 HTTP 控制器（多租户 S6 · FR-6/FR-10/FR-11①/FR-13）。
Remarks
Platform operator user-governance slice (global-tenancy S6 · FR-6/FR-10/FR-11①/FR-13).
Every route is gated by
PlatformOperatorGuard(the sole cross-platform authority, fail-closed). These handlers act WITHOUT a tenant scope on purpose: suspending a platform user revokes their access across every tenant and the platform layer (FR-10/FR-11), so they never bind TenantIsolationGuard.suspend (active→suspended) additionally hard-invalidates the user's sessions (D4 · §159); resume (suspended→active) lifts the deny-list. Each success/failure emits a structured audit line (FR-6).