Platform_default_role_abilities
Platform-wide default ability matrix for system herd roles
| Column Name | Data Type | Constraints |
|---|---|---|
| id | bigint | NOT NULL |
| system_name | text | NOT NULL, FK platform_default_roles ON DELETE CASCADE |
| ability_id | bigint | NOT NULL, FK abilities |
| inserted_at | timestamptz | NOT NULL |
Unique on (system_name, ability_id). system_name matches herd_roles.system_name for the system roles.
This table is the ability template for each Platform_default_roles row, copied into each new herd by seed_herd_default_roles. Every insert or delete here is mirrored by trigger (propagate_platform_default_role_ability) into the matching system role of every existing herd, so superadmin template edits take effect everywhere at once. The member-managing role's template must always include users_roles_per_herd.write (deferred constraint trigger enforce_platform_default_manager).
The template only describes system roles, so a custom herd_roles row keeps exactly what its herd admin granted and never inherits a later ability. A migration that adds an ability existing roles should already hold calls private.backfill_custom_role_abilities(ability_keys, holding_ability_key), which grants those keys to every custom role already holding holding_ability_key. Skipping that step leaves custom roles denied on any RLS policy or realtime topic that requires the new ability.
Security Policies (RLS)
RLS enabled. Herd scope: Not herd-scoped.
| Operation | has_herd_ability ability key | Other paths |
|---|---|---|
| SELECT | — | Platform superadmin |
| INSERT | — | Platform superadmin |
| UPDATE | — | Platform superadmin |
| DELETE | — | Platform superadmin |
Platform superadmin: FOR ALL bypass where defined.
No has_herd_ability on this platform table.
Management RPCs
Platform superadmin or service_role. Role rows themselves are managed through upsert_platform_default_role / delete_platform_default_role; see Platform_default_roles.
| Function | Behaviour |
|---|---|
get_platform_default_role_abilities() | Catalog roles with their ability keys, member-managing role first |
set_platform_default_role_abilities(system_name, ability_keys[]) | Replace the template for one role |
reset_herd_default_role_abilities(herd_id) | Repair one herd after direct edits: create missing system roles and re-apply templates (custom herd_roles untouched) |