Agents and Roles

Demo data

The role → permission matrix. AI service identities are first-class actors with the narrowest possible grant.

Permission	Group Owner	Company CEO	Dept Lead	Member	AI Service
group.read	●	○	○	○	○
group.manage	●	○	○	○	○
company.read	●	●	●	●	○
company.manage	●	●	○	○	○
department.read	●	●	●	●	○
department.manage	●	●	○	○	○
mission.read	●	●	●	●	●
mission.create	●	●	●	○	○
mission.manage	●	●	○	○	○
approval.read	●	●	●	●	○
approval.decide	●	●	○	○	○
audit.read	●	●	○	○	○
cost.read	●	●	●	○	○
integration.read	●	●	○	○	○
integration.manage	●	●	○	○	○
workflow.read	●	●	●	○	○
workflow.run	●	●	○	○	●
knowledge.read	●	●	●	●	●
knowledge.manage	●	●	○	○	○

● granted○ deniedDatabase RLS is the source of truth; this matrix mirrors it for UI reasoning only.