# DD-MOD-01 OKR Management

## Backend Design
Controllers are thin and call AuthService, UsersService, ObjectivesService, KeyResultsService. PrismaService is the only database access layer.

## Authorization
JwtAuthGuard verifies Bearer/cookie token. Employees are constrained to ownerId == user.sub. Managers/Admins read all objectives.

## Progress Calculation
KeyResultsService updates progress in a transaction, writes ProgressUpdate, then recalculates objective status.