Personas, roles, and what each one can actually reach

Answer a question about the estate. Reading the estate is open to every signed-in account on purpose. A requester who cannot see the answer cannot check what was done with their request.

Also refuses on: Logs the asking role against every attempt.

Generate a narrative brief. Each brief calls a paid model against the estate account and writes a document other people will quote. That is a spend, so it sits above the two lenses that only read and decide.

Also refuses on: Persists the brief against the signed-in account.

Write a model reading of one figure. The deterministic half of a click-drawer is a read and is open to everybody. The model reading beside it is a paid call on the estate account, so it sits at the same floor as a generated brief.

Also refuses on: The deterministic panel is still served in full to a role that cannot spend.

Record an executive decision. A decision binds the estate. A requester may raise work; they may not sign it off.

Also refuses on: ROLE-CEILING — a lens above the role cannot sign · SOD-01 — the raiser cannot also approve · AUTH-REGISTER — no grant, no decision.

Clear an item in the single queue. Clearing an item closes it for everybody downstream of it.

Also refuses on: QUEUE-OWNERSHIP — the item is addressed to one post and its named cover · SOD-01 — the raiser cannot also close it · AUTH-REGISTER — the cap has to reach the value at stake.

Commit a sandbox scenario. A committed scenario changes what the platform will do next. That is the process owner’s job, not the approver’s.

Also refuses on: ROLE-CEILING — the lens has to be one the role holds.

Save or pin a view. A saved view is a bookmark. It creates nothing another account can be held to, and a requester tracking their own work has as much reason to keep one as anybody.

Also refuses on: VIEW-09 — you cannot save a view you could not open.

Open a saved view. The floor lives on the view, not on the route: each saved view carries its own, and the loader applies it.

Also refuses on: The floor stored on the individual view.

Change the persona lens. Choosing a lens is a preference every account may set. What the lens is allowed to do is a separate question, answered by the role.

Also refuses on: PERSONA-CEILING — a lens above the role is not stored.

Pull a discovery export. A discovery export is the whole evidence spine in one file, leaving the platform. It is the one read on this list held above the process owner.

Also refuses on: Scoped to the calling account’s tenant.

Render an evidence pack. The pack is rendered by a paid service and is the document an approver hands to an auditor.

Probe the tenant boundary. The probe exists to be refused, and a refusal that names a boundary is itself information about how the estate is partitioned.

Also refuses on: TENANT-ISOLATION — the owning tenant is never named.

Read client extracts and the baseline. The baseline sets the client’s own cost per transaction next to the model. Every signed-in account may read it.

Also refuses on: Scoped to the calling account’s tenant.

Load a client extract file. A loaded extract changes the baseline every comparison reads, so it sits with the person who owns the process.

Also refuses on: INTAKE-SHAPE — a file without the template columns is refused whole · Rows that fail a check are kept out and listed.

Read governed parameters and their change history. Which rule value is in force, since when, and who approved it, is readable by every account.

Also refuses on: Scoped to the calling account’s tenant.

Propose, approve or reject a model change. Proposing needs a process owner. Approving needs an approver who did not make the proposal.

Also refuses on: ROLE-FLOOR — proposing a change needs a process owner · SOD-MAKER-CHECKER — the proposer cannot decide their own change · OUT-OF-RANGE — a value outside the declared bounds is refused.

Read station runs, exceptions and the outbox. The runs and what each one produced are readable by every account.

Also refuses on: Scoped to the calling account’s tenant.

Run the matching station or decide an exception. A run and a decision both commit work that leaves through the outbox.

Also refuses on: SOD-RUN-DECIDE — the account that started a run cannot decide its exceptions.

Verify the audit ledger. Anyone signed in may ask whether the ledger still verifies. The answer names no record contents.

Also refuses on: Scoped to the calling account’s tenant.

Place or release a legal hold on the audit ledger. A hold stops disposal for a whole tenant ledger, so it sits with the same role as a discovery export.

Also refuses on: HOLD-EXISTS — one active hold per ledger.

Export the audit ledger for an auditor. The export is the whole tenant ledger leaving the platform, the same exposure as a discovery export.

Also refuses on: Scoped to the calling account’s tenant.

Read directory group to role mappings. Which directory group grants which role is readable by every account.

Also refuses on: Scoped to the calling account’s tenant.

Map a directory group to a role. A mapping grants a role to everyone in a group at their next sign-in. That is privilege assignment.

Also refuses on: UNKNOWN-ROLE — only the platform roles can be mapped.

The page is a console for generating narrative briefs, and every generation calls a paid model against the estate account and produces a document other people will quote. more

Same floor on POST /api/brief · guard written in app/(cockpit)/brief/page.tsx

Committing a scenario changes what the platform will do next, for everybody. more

Same floor on POST /api/sandbox · guard written in app/(cockpit)/sandbox/page.tsx

Every row on this page is an item waiting for a human decision, and clearing one closes it for everybody downstream. more

Same floor on POST /api/queue/decide · guard written in app/(cockpit)/inbox/page.tsx

The page names every account that may sign in, the role the directory gives it, the tenant it belongs to, and where the boundary between the live estate and the sandbox sits. more

Same floor on POST /api/tenancy/probe · guard written in app/(cockpit)/identity/page.tsx