Abilities
Platform-wide permission keys for herd role matrices
| Column Name | Data Type | Constraints |
|---|---|---|
| id | bigint | NOT NULL |
| key | text | NOT NULL, unique |
| description | text | |
| is_system | boolean | DEFAULT false NOT NULL |
| inserted_at | timestamptz | NOT NULL |
System keys (is_system = true) are the ones RLS checks; the full map from key to tables is in Schemas. content.read / content.write remain in the catalog as deprecated grouping keys that no policy consults. Custom abilities may be added by platform superadmins (is_system = false) and are app-level groupings only.
Security Policies (RLS)
RLS enabled. Herd scope: Not herd-scoped.
| Operation | has_herd_ability ability key | Other paths |
|---|---|---|
| SELECT | — | All authenticated users (USING (true)) |
| INSERT | — | Platform superadmin; is_system = false |
| UPDATE | — | Platform superadmin; is_system = false |
| DELETE | — | No user policy |
Platform superadmin: FOR ALL bypass where defined.
No has_herd_ability on this catalog table.