Herd_role_abilities
Maps abilities to herd roles (permission matrix)
| Column Name | Data Type | Constraints |
|---|---|---|
| id | bigint | NOT NULL |
| herd_role_id | bigint | NOT NULL, FK herd_roles |
| ability_id | bigint | NOT NULL, FK abilities |
Unique on (herd_role_id, ability_id).
Security Policies (RLS)
RLS enabled. Herd scope: Herd from linked herd_roles.herd_id.
| Operation | has_herd_ability ability key | Other paths |
|---|---|---|
| SELECT | has_herd_ability_any: users_roles_per_herd.read or users_roles_per_herd.write | — |
| INSERT | users_roles_per_herd.write | Non-system herd_roles only |
| UPDATE | users_roles_per_herd.write | Non-system herd_roles only |
| DELETE | users_roles_per_herd.write | Non-system herd_roles only |
Platform superadmin: FOR ALL bypass where defined.
System roles' matrices are written only by the catalog: changes to Platform_default_role_abilities are propagated to every herd by trigger, and enforce_system_admin_role_abilities keeps users_roles_per_herd.write on the member-managing role even for superadmin edits.