Roles and permissions

Permissions is its own navigation section, separate from the admin panel, because managing users is not the same job as designing tables — and the two are often held by different people.

It answers three questions across three pages:

Page	Route	Question
Roles	/permissions/roles	which roles exist, and what they inherit
Users	/permissions/users	who holds which role
Grants	/permissions/grants	what a role may do

/permissions itself is an entry route that redirects to the first section the caller may open — roles if they manage roles, otherwise users.

Access

The section is gated on managing either roles or users, not on the admin panel:

• managing roles requires struct:role manage;
• managing users requires struct:user manage.

An account that manages neither receives 403. Each page’s tabs are shown or hidden according to which of the two areas the caller manages.

The role hierarchy

The section mirrors the server’s authority ranking so it only offers what the server will accept: superadmin outranks admin, admin outranks every data role, and no role outranks itself. A caller can only edit roles and users it outranks.

For the full model — planes, grants, inheritance, and the audit log — see the server chapter Roles and permissions.