Herd_roles
Per-herd role definitions and stable system names
| Column Name | Data Type | Constraints |
|---|---|---|
| id | bigint | NOT NULL |
| herd_id | bigint | NOT NULL, FK herds |
| system_name | text | NOT NULL, unique per herd |
| name | text | NOT NULL |
| is_system | boolean | DEFAULT false NOT NULL |
| inserted_at | timestamptz | NOT NULL |
System roles (is_system = true) are seeded on herd creation by seed_herd_default_roles from Platform_default_roles (admin, editor, viewer unless the catalog has been changed). The herd creator is enrolled in the catalog's member-managing role. System roles mirror the catalog: renaming a catalog role, changing its template, or registering a new one is applied to every herd, and deleting a catalog role turns each herd's copy into an ordinary custom role (is_system = false) that keeps its abilities. Herd admins may create and shape non-system roles only; system roles cannot be inserted, changed, or deleted through RLS. When two accounts holding roles in the same herd are merged, the membership keeps the role with fewer abilities.
Security Policies (RLS)
RLS enabled. Herd scope: Herd from herd_roles.herd_id.
| Operation | has_herd_ability ability key | Other paths |
|---|---|---|
| SELECT | has_herd_ability_any: users_roles_per_herd.read or users_roles_per_herd.write | — |
| INSERT | users_roles_per_herd.write | is_system = false required |
| UPDATE | users_roles_per_herd.write | is_system = false required before and after |
| DELETE | users_roles_per_herd.write | is_system = false required |
Platform superadmin: FOR ALL bypass where defined.