Platform_default_roles
Catalog of the system roles created in every new herd
| Column Name | Data Type | Constraints |
|---|---|---|
| system_name | text | PRIMARY KEY, ^[a-z][a-z0-9_]*$, immutable after insert |
| name | text | NOT NULL, non-blank; display name copied to herd_roles.name |
| description | text | |
| manages_members | boolean | NOT NULL DEFAULT false; exactly one row is true |
| inserted_at | timestamptz | NOT NULL |
Each row becomes an is_system Herd_roles row in every herd created afterwards, with the abilities listed for it in Platform_default_role_abilities. The row with manages_members is assigned to the herd creator and its template must include users_roles_per_herd.write; both rules are checked by a deferred constraint trigger so one transaction can move the flag between roles. Seeded with admin (manages members), editor, and viewer.
Every herd's system roles mirror the catalog through triggers: registering a role creates it in every herd (re-adopting a same-named custom role if one exists), renaming it renames every copy, template changes are applied to every copy, and deleting a role converts each herd's copy into a custom role (is_system = false) that keeps its abilities. reset_herd_default_role_abilities(herd_id) is a repair tool that re-mirrors the catalog into one herd after direct superadmin edits. The foreign key from platform_default_role_abilities means private.add_system_ability(key, description, default_roles) rejects role names that are not in this table.
Security Policies (RLS)
RLS enabled. Herd scope: Not herd-scoped.
| Operation | has_herd_ability ability key | Other paths |
|---|---|---|
| SELECT | — | Platform superadmin |
| INSERT | — | Platform superadmin |
| UPDATE | — | Platform superadmin |
| DELETE | — | Platform superadmin |
Management RPCs
Platform superadmin or service_role.
| Function | Behaviour |
|---|---|
get_platform_default_role_abilities() | Catalog rows with their ability templates, member-managing role first |
upsert_platform_default_role(system_name, name, description, manages_members, ability_keys[]) | Create or update a role. Null arguments keep existing values; manages_members = true moves the flag from the current manager; ability_keys replaces the template |
delete_platform_default_role(system_name) | Remove a role and its template. Refuses the member-managing role |
set_platform_default_role_abilities(system_name, ability_keys[]) | Replace one role's template |
reset_herd_default_role_abilities(herd_id) | Repair: re-mirror the catalog into one herd. Fails if it would leave a herd that had a member manager without one |