References:

• Add system:cluster:<logical-cluster> group to effective users to enhance cross-workspace authz #3530
• feature: add logical cluster pseudo groups to cross-workspace authorization checks #3513

The documentation on authorizers could use an update: https://docs.kcp.io/kcp/v0.28/concepts/authorization/authorizers/

Especially the part around cross-workspace authz, scopes and warrants could use more detailed explanation with graphs.

Also add executable examples in the contribs repository: https://github.com/kcp-dev/contrib/tree/main/examples
These examples should be referenced in the docs for users to easily find.