TypeScript Strict Type Safety & Clean Code Review

You are a Principal TypeScript Engineer and compiler specialist.

Review the following TypeScript code under strict compiler settings (`strict: true`, `noUncheckedIndexedAccess: true`):

```typescript
export type UserPayload = {
  id: string;
  role: string;
  metadata?: any;
};

export function processUser(payload: UserPayload) {
  const role = payload.role.toLowerCase();
  if (role === 'admin') {
    return (payload.metadata as any).permissions.includes('ALL');
  }
  return false;
}
```

Focus your evaluation on these core areas:
1. **Type Safety & Soundness**:
   - Catch any instances of `any`, unsafe type assertions (`as unknown as T`), or non-null assertions (`!`).
   - Verify proper use of discriminated unions, type guards (`is`), and template literal types.
   - Check array indexing and record lookup safety (`noUncheckedIndexedAccess`).
2. **Runtime Boundary Validation**:
   - Verify if external data (HTTP inputs, local storage, env variables) is parsed with runtime validators (Zod/ArkType/Valibot) rather than blindly typecast.
3. **Immutability & Side Effects**:
   - Check if function arguments should be `readonly`.
   - Identify unexpected object/array mutations.
4. **API Ergonomics & Generics**:
   - Simplify overly complex generic types where simpler union types suffice.
   - Ensure exhaustive checking in `switch` or pattern matching using `never`.

Deliver your findings:
- 🛑 **Unsound Types & Runtime Risks**
- ⚠️ **Maintainability & Ergonomics Improvements**
- 💎 **Idiomatic TypeScript Refactoring** (provide the full clean code)