Admin
System role catalog, global custom roles, permissions, and admin RBAC boundaries.
Admin Roles and Permissions is the system-scoped RBAC management surface.
The admin overview lists built-in roles plus admin-created global roles. Organization-admin-created custom roles stay in organization role pages.
Built-in roles are not deletable. Delete affordances are reserved for deletable custom roles.
Permissions are typed in packages/identity/src/rbac/permissions.ts and mirrored by SQL seeds. Do not create permissions speculatively; only add them when the corresponding feature has tables, RLS, API/server actions, and UI.
Organization role pages include organization-owned roles and global roles. Global role rows are read-only from organization-scoped pages.
Admin role writes must use system permission checks. UI hints can hide or disable controls, but server actions and RLS remain authoritative.