@ketvietlab/ketsuite 0.1.2 → 0.1.5

package/dist/permission-catalogue.js

@@ -0,0 +1,1518 @@
+const sources = {
+    account: {
+        posture: 'permission-bearing',
+        bundles: ['approve', 'configure', 'operate', 'sensitive'],
+        functions: {
+            accountingBook: ['operate', 'operate'],
+            addMoveLine: ['operate', 'operate'],
+            approveCashCountDifference: ['approve', 'approve', 'account.domain-policy'],
+            approveCostAdjustmentProposal: ['approve', 'approve', 'account.domain-policy'],
+            assetReconciliation: ['operate', 'operate'],
+            cancelMove: ['approve', 'approve', 'account.domain-policy'],
+            cashFlow: ['operate', 'operate'],
+            changePeriodLock: ['operate', 'operate'],
+            closePeriod: ['approve', 'approve', 'account.domain-policy'],
+            completeAssetChange: ['approve', 'approve', 'account.domain-policy'],
+            configureFxPolicy: ['operate', 'operate'],
+            countMoves: ['sensitive', 'sensitive', 'account.sensitive-data'],
+            createAsset: ['operate', 'operate'],
+            createCashCount: ['operate', 'operate'],
+            createCashDocument: ['operate', 'operate'],
+            createClosePeriod: ['configure', 'configure', 'account.configuration-audit'],
+            createCostAdjustmentProposal: ['configure', 'configure', 'account.configuration-audit'],
+            createInvoice: ['operate', 'operate'],
+            createMove: ['operate', 'operate'],
+            finalizeCostRun: ['approve', 'approve', 'account.domain-policy'],
+            generalLedger: ['sensitive', 'sensitive', 'account.sensitive-data'],
+            getClosePeriod: ['sensitive', 'sensitive', 'account.sensitive-data'],
+            getCustomerInvoiceReport: ['sensitive', 'sensitive', 'account.sensitive-data'],
+            getDefaults: ['sensitive', 'sensitive', 'account.sensitive-data'],
+            getFxPolicy: ['sensitive', 'sensitive', 'account.sensitive-data'],
+            getMove: ['sensitive', 'sensitive', 'account.sensitive-data'],
+            getOpeningBatch: ['sensitive', 'sensitive', 'account.sensitive-data'],
+            getOpenItemBatch: ['sensitive', 'sensitive', 'account.sensitive-data'],
+            getPeriodPolicy: ['sensitive', 'sensitive', 'account.sensitive-data'],
+            getProductTax: ['sensitive', 'sensitive', 'account.sensitive-data'],
+            getSetup: ['sensitive', 'sensitive', 'account.sensitive-data'],
+            getVendorBillReport: ['sensitive', 'sensitive', 'account.sensitive-data'],
+            importBankStatement: ['sensitive', 'sensitive', 'account.sensitive-data'],
+            importOpenItems: ['sensitive', 'sensitive', 'account.sensitive-data'],
+            initializeCompany: ['operate', 'operate'],
+            listAccounts: ['sensitive', 'sensitive', 'account.sensitive-data'],
+            listAssetCategories: ['sensitive', 'sensitive', 'account.sensitive-data'],
+            listAssetEvents: ['sensitive', 'sensitive', 'account.sensitive-data'],
+            listAssets: ['sensitive', 'sensitive', 'account.sensitive-data'],
+            listAssetSchedule: ['sensitive', 'sensitive', 'account.sensitive-data'],
+            listAuditEvents: ['sensitive', 'sensitive', 'account.sensitive-data'],
+            listBankAccounts: ['sensitive', 'sensitive', 'account.sensitive-data'],
+            listBankImportProfiles: ['sensitive', 'sensitive', 'account.sensitive-data'],
+            listBankReconciliations: ['sensitive', 'sensitive', 'account.sensitive-data'],
+            listBankTransactions: ['sensitive', 'sensitive', 'account.sensitive-data'],
+            listCashCounts: ['sensitive', 'sensitive', 'account.sensitive-data'],
+            listCategoryAccounts: ['sensitive', 'sensitive', 'account.sensitive-data'],
+            listClosePeriods: ['sensitive', 'sensitive', 'account.sensitive-data'],
+            listCostRuns: ['sensitive', 'sensitive', 'account.sensitive-data'],
+            listCostVariances: ['sensitive', 'sensitive', 'account.sensitive-data'],
+            listFollowUpCases: ['sensitive', 'sensitive', 'account.sensitive-data'],
+            listFollowUpMessages: ['sensitive', 'sensitive', 'account.sensitive-data'],
+            listJournals: ['sensitive', 'sensitive', 'account.sensitive-data'],
+            listMoveResiduals: ['sensitive', 'sensitive', 'account.sensitive-data'],
+            listMoves: ['sensitive', 'sensitive', 'account.sensitive-data'],
+            listOpeningBatches: ['sensitive', 'sensitive', 'account.sensitive-data'],
+            listOpenItemBatches: ['sensitive', 'sensitive', 'account.sensitive-data'],
+            listOpenItems: ['sensitive', 'sensitive', 'account.sensitive-data'],
+            listPayments: ['sensitive', 'sensitive', 'account.sensitive-data'],
+            listPaymentTerms: ['sensitive', 'sensitive', 'account.sensitive-data'],
+            listPeriodLockEvents: ['sensitive', 'sensitive', 'account.sensitive-data'],
+            listTaxes: ['sensitive', 'sensitive', 'account.sensitive-data'],
+            openItemSummary: ['operate', 'operate'],
+            partnerStatement: ['sensitive', 'sensitive', 'account.sensitive-data'],
+            performance: ['operate', 'operate'],
+            position: ['operate', 'operate'],
+            postAssetScheduleLine: ['approve', 'approve', 'account.domain-policy'],
+            postBankReconciliation: ['approve', 'approve', 'account.domain-policy'],
+            postMove: ['approve', 'approve', 'account.domain-policy'],
+            postOpeningBatch: ['approve', 'approve', 'account.domain-policy'],
+            postStoredValueBalance: ['approve', 'approve', 'account.domain-policy'],
+            prepareOpeningBatch: ['operate', 'operate'],
+            previewAccounts: ['operate', 'operate'],
+            previewBankStatement: ['sensitive', 'sensitive', 'account.sensitive-data'],
+            proposeAssetChange: ['operate', 'operate'],
+            queueFollowUpMessage: ['operate', 'operate'],
+            quoteLine: ['operate', 'operate'],
+            receivableAging: ['operate', 'operate'],
+            reconcile: ['approve', 'approve', 'account.domain-policy'],
+            recordFollowUpDelivery: ['operate', 'operate'],
+            refreshClosePeriod: ['operate', 'operate'],
+            registerInvoicePayment: ['operate', 'operate'],
+            registerPayment: ['operate', 'operate'],
+            reopenClosePeriod: ['approve', 'approve', 'account.domain-policy'],
+            revenueTimeline: ['operate', 'operate'],
+            reverseMove: ['approve', 'approve', 'account.domain-policy'],
+            runAssetBatch: ['operate', 'operate'],
+            saveAccount: ['configure', 'configure', 'account.configuration-audit'],
+            saveAssetCategory: ['operate', 'operate'],
+            saveBankAccount: ['configure', 'configure', 'account.configuration-audit'],
+            saveBankImportProfile: ['configure', 'configure', 'account.configuration-audit'],
+            saveCategoryAccount: ['configure', 'configure', 'account.configuration-audit'],
+            saveCostPolicy: ['configure', 'configure', 'account.configuration-audit'],
+            saveDefaults: ['configure', 'configure', 'account.configuration-audit'],
+            saveFollowUpCase: ['operate', 'operate'],
+            saveFollowUpPolicy: ['operate', 'operate'],
+            saveJournal: ['configure', 'configure', 'account.configuration-audit'],
+            saveMatchRule: ['configure', 'configure', 'account.configuration-audit'],
+            savePaymentTerm: ['operate', 'operate'],
+            savePaymentTermLine: ['operate', 'operate'],
+            saveTax: ['configure', 'configure', 'account.configuration-audit'],
+            setProductTax: ['configure', 'configure', 'account.configuration-audit'],
+            startCostRun: ['operate', 'operate'],
+            suggestBankMatches: ['operate', 'operate'],
+            transitionAsset: ['approve', 'approve', 'account.domain-policy'],
+            trialBalance: ['operate', 'operate'],
+            undoBankReconciliation: ['operate', 'operate'],
+        },
+        exemptions: {},
+    },
+    account_backend: {
+        posture: 'projection/bridge',
+        bundles: [],
+        functions: {},
+        exemptions: {},
+    },
+    account_staff_channel: {
+        posture: 'projection/bridge',
+        bundles: ['approve', 'operate', 'view'],
+        functions: {
+            beginInvoiceCommand: ['operate', 'operate'],
+            completeInvoiceCommand: ['approve', 'approve', 'account_staff_channel.domain-policy'],
+            getInvoiceCommand: ['read', 'view'],
+        },
+        exemptions: {},
+    },
+    activity: {
+        posture: 'permission-bearing',
+        bundles: ['approve', 'configure', 'operate', 'view'],
+        functions: {
+            cancel: ['approve', 'approve', 'activity.domain-policy'],
+            complete: ['approve', 'approve', 'activity.domain-policy'],
+            countDue: ['read', 'view'],
+            listMy: ['read', 'view'],
+            listPlans: ['read', 'view'],
+            listTypes: ['read', 'view'],
+            reschedule: ['operate', 'operate'],
+            savePlan: ['configure', 'configure', 'activity.configuration-audit'],
+            saveType: ['configure', 'configure', 'activity.configuration-audit'],
+        },
+        exemptions: {},
+    },
+    address: {
+        posture: 'permission-bearing',
+        bundles: ['approve', 'operate', 'view'],
+        functions: {
+            availableCatalogs: ['operate', 'operate'],
+            catalogStatus: ['operate', 'operate'],
+            format: ['operate', 'operate'],
+            listCountries: ['read', 'view'],
+            listDivisionChildren: ['read', 'view'],
+            resolveDivisionPath: ['operate', 'operate'],
+            snapshot: ['operate', 'operate'],
+            validate: ['approve', 'approve', 'address.domain-policy'],
+        },
+        exemptions: {
+            installCatalog: ['internal-route', 'address.trusted-route-worker-or-service'],
+        },
+    },
+    attendance: {
+        posture: 'permission-bearing',
+        bundles: ['configure', 'operate', 'sensitive'],
+        functions: {
+            'calendar.mine': ['operate', 'operate'],
+            'clock.mine': ['operate', 'operate'],
+            'correction.manageDecision': ['configure', 'configure', 'attendance.configuration-audit'],
+            'correction.request': ['operate', 'operate'],
+            'credential.manageOptions': ['sensitive', 'sensitive', 'attendance.sensitive-data'],
+            'overtime.manageDecision': ['configure', 'configure', 'attendance.configuration-audit'],
+            'period.export': ['sensitive', 'sensitive', 'attendance.sensitive-data'],
+            'period.manageClose': ['configure', 'configure', 'attendance.configuration-audit'],
+            'period.manageReopen': ['configure', 'configure', 'attendance.configuration-audit'],
+            'period.report': ['sensitive', 'sensitive', 'attendance.sensitive-data'],
+            'policy.save': ['configure', 'configure', 'attendance.configuration-audit'],
+            'punch.self': ['operate', 'operate'],
+            'session.mine': ['operate', 'operate'],
+        },
+        exemptions: {
+            'credential.managePin': ['internal-route', 'attendance.trusted-route-worker-or-service'],
+            'credential.manageQr': ['internal-route', 'attendance.trusted-route-worker-or-service'],
+            'kiosk.manageIssue': ['internal-route', 'attendance.trusted-route-worker-or-service'],
+            'punch.kiosk': ['anonymous', 'declared-public-or-cryptographic-realm-boundary'],
+        },
+    },
+    backend: {
+        posture: 'internal/headless',
+        bundles: [],
+        functions: {},
+        exemptions: {
+            archiveSavedSearch: ['internal-route', 'backend.trusted-route-worker-or-service'],
+            listSavedSearches: ['internal-route', 'backend.trusted-route-worker-or-service'],
+            saveSavedSearch: ['internal-route', 'backend.trusted-route-worker-or-service'],
+            setDefaultSavedSearch: ['internal-route', 'backend.trusted-route-worker-or-service'],
+        },
+    },
+    business_report_staff_channel: {
+        posture: 'projection/bridge',
+        bundles: [],
+        functions: {},
+        exemptions: {},
+    },
+    calendar: {
+        posture: 'permission-bearing',
+        bundles: ['approve', 'configure', 'operate', 'view'],
+        functions: {
+            availability: ['operate', 'operate'],
+            cancelEvent: ['approve', 'approve', 'calendar.domain-policy'],
+            listAgenda: ['read', 'view'],
+            saveEvent: ['operate', 'operate'],
+            saveTag: ['configure', 'configure', 'calendar.configuration-audit'],
+        },
+        exemptions: {
+            rsvp: ['anonymous', 'declared-public-or-cryptographic-realm-boundary'],
+        },
+    },
+    channel_api: {
+        posture: 'internal/headless',
+        bundles: [],
+        functions: {},
+        exemptions: {},
+    },
+    company: {
+        posture: 'permission-bearing',
+        bundles: ['configure', 'view'],
+        functions: {
+            archiveBranch: ['configure', 'configure', 'company.configuration-audit'],
+            archiveCompany: ['configure', 'configure', 'company.configuration-audit'],
+            getCompany: ['read', 'view'],
+            listBranches: ['read', 'view'],
+            listCompanies: ['read', 'view'],
+            saveBranch: ['configure', 'configure', 'company.configuration-audit'],
+            saveCompany: ['configure', 'configure', 'company.configuration-audit'],
+        },
+        exemptions: {
+            contextLabels: ['internal-route', 'company.trusted-route-worker-or-service'],
+        },
+    },
+    crm: {
+        posture: 'permission-bearing',
+        bundles: ['agent-operate', 'analytics', 'approve', 'assignment', 'configure', 'merge', 'report', 'view'],
+        functions: {
+            'access.get': ['read', 'view'],
+            'access.save': ['configure', 'configure', 'crm.configuration-audit'],
+            'activity.cancel': ['approve', 'approve', 'crm.domain-policy'],
+            'activity.complete': ['approve', 'approve', 'crm.domain-policy'],
+            'activity.listMine': ['read', 'view'],
+            'activity.schedule': ['operate', 'agent-operate'],
+            'assignmentRule.save': ['configure', 'configure', 'crm.configuration-audit'],
+            'bootstrap.defaults': ['configure', 'configure', 'crm.configuration-audit'],
+            'calendar.list': ['read', 'view'],
+            'case.addMessage': ['operate', 'agent-operate'],
+            'case.assign': ['approve', 'assignment', 'crm.assignment-policy'],
+            'case.convertLead': ['operate', 'agent-operate'],
+            'case.count': ['read', 'view'],
+            'case.detectDuplicates': ['sensitive', 'analytics', 'crm.sensitive-data'],
+            'case.get': ['read', 'view'],
+            'case.group': ['read', 'report'],
+            'case.list': ['read', 'view'],
+            'case.markLost': ['approve', 'approve', 'crm.domain-policy'],
+            'case.markWon': ['approve', 'approve', 'crm.domain-policy'],
+            'case.merge': ['approve', 'merge', 'crm.merge-policy'],
+            'case.move': ['operate', 'agent-operate'],
+            'case.options': ['read', 'view'],
+            'case.reassign': ['approve', 'assignment', 'crm.assignment-policy'],
+            'case.refreshScore': ['operate', 'analytics'],
+            'case.save': ['operate', 'agent-operate'],
+            'configuration.get': ['read', 'view'],
+            'enrichment.preview': ['sensitive', 'analytics', 'crm.sensitive-data'],
+            'gamification.list': ['read', 'view'],
+            'gamification.refresh': ['operate', 'analytics'],
+            'mining.preview': ['sensitive', 'analytics', 'crm.sensitive-data'],
+            overview: ['read', 'report'],
+            'pipeline.summary': ['read', 'report'],
+            'plan.apply': ['configure', 'configure', 'crm.configuration-audit'],
+            'scoreRule.save': ['configure', 'configure', 'crm.configuration-audit'],
+            'stage.list': ['read', 'view'],
+            'stage.save': ['configure', 'configure', 'crm.configuration-audit'],
+            'tag.archive': ['configure', 'configure', 'crm.configuration-audit'],
+            'tag.list': ['read', 'view'],
+            'tag.save': ['configure', 'configure', 'crm.configuration-audit'],
+            'team.list': ['read', 'view'],
+            'team.member.list': ['read', 'view'],
+            'team.member.remove': ['configure', 'configure', 'crm.configuration-audit'],
+            'team.member.save': ['configure', 'configure', 'crm.configuration-audit'],
+            'team.save': ['configure', 'configure', 'crm.configuration-audit'],
+        },
+        exemptions: {},
+    },
+    crm_backend: {
+        posture: 'projection/bridge',
+        bundles: [],
+        functions: {},
+        exemptions: {},
+    },
+    crm_sale: {
+        posture: 'permission-bearing',
+        bundles: ['configure', 'view'],
+        functions: {
+            'sale.createQuotation': ['configure', 'configure', 'crm_sale.configuration-audit'],
+            'sale.listQuotableProducts': ['read', 'view'],
+            'sale.listQuotations': ['read', 'view'],
+        },
+        exemptions: {},
+    },
+    crm_staff_channel: {
+        posture: 'projection/bridge',
+        bundles: [],
+        functions: {},
+        exemptions: {},
+    },
+    crm_website: {
+        posture: 'projection/bridge',
+        bundles: [],
+        functions: {},
+        exemptions: {
+            'website.submitLead': ['anonymous', 'declared-public-or-cryptographic-realm-boundary'],
+        },
+    },
+    flow: {
+        posture: 'permission-bearing',
+        bundles: ['author', 'configure', 'operate', 'project-access', 'project-delete', 'view'],
+        functions: {
+            'board.remember': ['operate', 'operate'],
+            'board.scope': ['read', 'view'],
+            'column.archive': ['configure', 'configure', 'flow.configuration-audit'],
+            'column.list': ['read', 'view'],
+            'column.save': ['configure', 'configure', 'flow.configuration-audit'],
+            'epic.archive': ['operate', 'operate'],
+            'epic.editContent': ['operate', 'author'],
+            'epic.get': ['read', 'view'],
+            'epic.list': ['read', 'view'],
+            'epic.listAll': ['read', 'view'],
+            'epic.save': ['operate', 'operate'],
+            'field.archive': ['configure', 'configure', 'flow.configuration-audit'],
+            'field.list': ['read', 'view'],
+            'field.save': ['configure', 'configure', 'flow.configuration-audit'],
+            // Taking work out of every figure the project reports, and putting it
+            // back. Ordinary work rather than configuration: cancelling your own task
+            // is not a decision about how the project is run.
+            'issue.archive': ['operate', 'operate'],
+            'issue.restore': ['operate', 'operate'],
+            'issue.assignSprint': ['operate', 'operate'],
+            'issue.bulk': ['operate', 'operate'],
+            'issue.copyTo': ['operate', 'operate'],
+            'issue.transfer': ['operate', 'operate'],
+            'issue.buckets': ['read', 'view'],
+            'issue.comment': ['operate', 'operate'],
+            'issue.dependencies': ['read', 'view'],
+            'issue.dependency.add': ['operate', 'operate'],
+            'issue.dependency.remove': ['operate', 'operate'],
+            'issue.editDescription': ['operate', 'author'],
+            'issue.get': ['read', 'view'],
+            'issue.group': ['read', 'view'],
+            'issue.list': ['read', 'view'],
+            'issue.move': ['operate', 'operate'],
+            'issue.options': ['read', 'view'],
+            'issue.save': ['operate', 'operate'],
+            'issue.follow': ['operate', 'operate'],
+            'issue.unfollow': ['operate', 'operate'],
+            'issueType.archive': ['configure', 'configure', 'flow.configuration-audit'],
+            'issueType.list': ['read', 'view'],
+            'issueType.save': ['configure', 'configure', 'flow.configuration-audit'],
+            'page.archive': ['operate', 'operate'],
+            'page.editContent': ['operate', 'author'],
+            'page.get': ['read', 'view'],
+            'page.list': ['read', 'view'],
+            'page.listAll': ['read', 'view'],
+            // Re-parenting moves a whole branch of the wiki, not one record.
+            'page.move': ['configure', 'configure', 'flow.domain-policy'],
+            'page.reorder': ['operate', 'operate'],
+            'page.restore': ['operate', 'operate'],
+            'page.save': ['operate', 'operate'],
+            // The widest reach Flow grants: reading every project regardless of who
+            // was added to it. Its own capability, so nobody holds it by holding
+            // something else, and a policy authority because it is the answer to
+            // "who can see the project we hid".
+            'project.access.grant': ['security', 'project-access', 'flow.domain-policy'],
+            'project.count': ['read', 'view'],
+            'project.access.list': ['sensitive', 'project-access', 'flow.domain-policy'],
+            'project.access.revoke': ['security', 'project-access', 'flow.domain-policy'],
+            // Ending a project is not configuring one. Its own capability so that a
+            // role which reshapes boards every week cannot destroy one by accident,
+            // and its own policy authority because the act does not come back.
+            'project.delete': ['security', 'project-delete', 'flow.domain-policy'],
+            'project.deletion.list': ['sensitive', 'project-delete', 'flow.domain-policy'],
+            'project.editContent': ['operate', 'author'],
+            'project.get': ['read', 'view'],
+            'project.list': ['read', 'view'],
+            // Who is on a project decides what they may read, which is a decision
+            // about the project rather than a day of work in it.
+            'project.member.add': ['configure', 'configure', 'flow.configuration-audit'],
+            'project.member.list': ['read', 'view'],
+            'project.member.remove': ['configure', 'configure', 'flow.configuration-audit'],
+            'project.save': ['configure', 'configure', 'flow.configuration-audit'],
+            'project.stats': ['read', 'view'],
+            'sprint.close': ['operate', 'operate'],
+            'sprint.delete': ['operate', 'operate'],
+            'sprint.list': ['read', 'view'],
+            'sprint.save': ['operate', 'operate'],
+            'sprint.start': ['operate', 'operate'],
+            // Archiving a tag removes it from every issue in every project of the
+            // company and cannot be undone — a wider reach than the rest of `configure`.
+            'tag.archive': ['configure', 'configure', 'flow.configuration-audit'],
+            'tag.list': ['read', 'view'],
+            'tag.save': ['configure', 'configure', 'flow.configuration-audit'],
+        },
+        exemptions: {},
+    },
+    // Routes only, no functions of its own: every read and command reaches Flow
+    // through `ctx.call`, which is what makes project membership apply to the
+    // phone without the rule being written a second time (FLW-DEC-019).
+    flow_staff_channel: {
+        posture: 'projection/bridge',
+        bundles: [],
+        functions: {},
+        exemptions: {},
+    },
+    flow_backend: {
+        posture: 'projection/bridge',
+        bundles: [],
+        functions: {},
+        exemptions: {
+            // `exposure: 'internal'`: the generic /_ket/fn/ path refuses these outright.
+            // Live Doc calls them through the route that has already run its own record
+            // permission check — see documentRoutes and the DocumentOwner seam.
+            'sync.commitContent': ['internal-route', 'flow_backend.trusted-route-worker-or-service'],
+            'sync.commitEpicContent': ['internal-route', 'flow_backend.trusted-route-worker-or-service'],
+            'sync.commitPageContent': ['internal-route', 'flow_backend.trusted-route-worker-or-service'],
+            'sync.commitProjectContent': ['internal-route', 'flow_backend.trusted-route-worker-or-service'],
+        },
+    },
+    hospitality_billing: {
+        posture: 'permission-bearing',
+        bundles: ['approve', 'configure', 'operate', 'view'],
+        functions: {
+            getFolioBilling: ['read', 'view'],
+            invoiceFolio: ['approve', 'approve', 'hospitality_billing.domain-policy'],
+            listChargeRules: ['read', 'view'],
+            queueClosedFolios: ['operate', 'operate'],
+            recordFolioPayment: ['operate', 'operate'],
+            saveChargeRule: ['configure', 'configure', 'hospitality_billing.configuration-audit'],
+        },
+        exemptions: {},
+    },
+    hospitality_core: {
+        posture: 'permission-bearing',
+        bundles: [
+            'approve',
+            'compliance-operate',
+            'configure',
+            'housekeeping-attend',
+            'housekeeping-supervise',
+            'night-audit',
+            'operate',
+            'property-reference',
+            'reservation-input',
+            'revenue-operate',
+            'sensitive',
+            'view',
+        ],
+        functions: {
+            addCharge: ['operate', 'operate'],
+            addStayGuest: ['operate', 'operate'],
+            adjustStayDeparture: ['operate', 'operate'],
+            amendReservation: ['operate', ['operate', 'reservation-input']],
+            archiveBuilding: ['configure', 'configure', 'hospitality_core.configuration-audit'],
+            archiveFloor: ['configure', 'configure', 'hospitality_core.configuration-audit'],
+            archiveProperty: ['configure', 'configure', 'hospitality_core.configuration-audit'],
+            archiveRoom: ['configure', 'configure', 'hospitality_core.configuration-audit'],
+            assignAmenity: ['configure', 'configure', 'hospitality_core.configuration-audit'],
+            attachContentImage: ['operate', 'operate'],
+            cancelCleaningTask: [
+                'approve',
+                ['approve', 'housekeeping-supervise'],
+                'hospitality_core.domain-policy',
+            ],
+            cancelReservation: ['approve', 'approve', 'hospitality_core.domain-policy'],
+            checkIn: ['operate', 'operate'],
+            checkOut: ['operate', 'operate'],
+            checkOutReadiness: ['read', ['view', 'operate']],
+            cleaningTaskSummary: ['operate', ['operate', 'housekeeping-attend', 'housekeeping-supervise']],
+            completeCleaningTask: ['approve', ['approve', 'housekeeping-attend'], 'hospitality_core.domain-policy'],
+            confirmStayNotice: ['approve', ['approve', 'compliance-operate'], 'hospitality_core.domain-policy'],
+            createCleaningTask: ['operate', ['operate', 'housekeeping-supervise']],
+            createReservation: ['operate', ['operate', 'reservation-input']],
+            getBuilding: ['read', 'view'],
+            getCleaningTask: ['read', ['view', 'housekeeping-attend']],
+            getFloor: ['read', 'view'],
+            getFolio: ['read', ['view', 'night-audit']],
+            getHousekeepingRoom: ['read', ['view', 'housekeeping-supervise']],
+            getProperty: [
+                'read',
+                ['view', 'night-audit', 'property-reference', 'reservation-input', 'revenue-operate'],
+            ],
+            getReservation: ['read', ['view', 'night-audit', 'reservation-input', 'revenue-operate']],
+            getRoom: ['read', ['view', 'revenue-operate']],
+            getRoomType: ['read', ['view', 'reservation-input', 'revenue-operate']],
+            getStay: ['read', ['view', 'night-audit']],
+            getTapeChart: ['read', ['view', 'reservation-input', 'revenue-operate']],
+            listAmenities: ['read', 'view'],
+            listAmenityCategories: ['read', 'view'],
+            listBuildings: ['read', 'view'],
+            listCancellationPolicies: ['read', ['view', 'reservation-input', 'revenue-operate']],
+            listCleaningTasks: ['read', ['view', 'housekeeping-attend']],
+            listContentChanges: ['read', 'view'],
+            listContentImages: ['read', 'view'],
+            listExtraLines: ['read', 'view'],
+            listFloors: ['read', 'view'],
+            listFolios: ['read', ['view', 'night-audit']],
+            listGuestDocuments: ['read', 'view'],
+            listInventory: ['read', ['view', 'reservation-input', 'revenue-operate']],
+            listInventoryChanges: ['read', ['view', 'revenue-operate']],
+            listNightAudits: ['sensitive', ['sensitive', 'night-audit'], 'hospitality_core.sensitive-data'],
+            listProperties: [
+                'read',
+                ['view', 'night-audit', 'property-reference', 'reservation-input', 'revenue-operate'],
+            ],
+            listPropertyCharges: ['read', 'view'],
+            listRatePlans: ['read', ['view', 'reservation-input', 'revenue-operate']],
+            listReservations: ['read', ['view', 'night-audit', 'reservation-input', 'revenue-operate']],
+            listRooms: ['read', ['view', 'housekeeping-supervise', 'revenue-operate']],
+            listRoomTypes: ['read', ['view', 'reservation-input', 'revenue-operate']],
+            listServiceCharges: ['read', 'view'],
+            listServiceProducts: ['read', 'view'],
+            listStayGuests: ['read', 'view'],
+            listStayNotices: ['read', ['view', 'compliance-operate']],
+            listStays: ['read', ['view', 'night-audit']],
+            markNoShow: ['approve', ['approve', 'night-audit'], 'hospitality_core.domain-policy'],
+            materializeExtraLine: ['operate', 'operate'],
+            holdRoom: ['operate', 'operate'],
+            moveRoom: ['operate', 'operate'],
+            releaseRoomHold: ['operate', 'operate'],
+            previewNightAudit: ['sensitive', ['sensitive', 'night-audit'], 'hospitality_core.sensitive-data'],
+            quoteReservation: ['operate', ['operate', 'reservation-input']],
+            recordStayNoticeSubmission: ['operate', ['operate', 'compliance-operate']],
+            removeContentImage: ['operate', 'operate'],
+            reorderContentImages: ['operate', 'operate'],
+            requestNightAudit: ['sensitive', ['sensitive', 'night-audit'], 'hospitality_core.sensitive-data'],
+            requestStayNoticeRefresh: ['operate', ['operate', 'compliance-operate']],
+            roomStatusSummary: ['operate', ['operate', 'housekeeping-supervise']],
+            saveAmenity: ['configure', 'configure', 'hospitality_core.configuration-audit'],
+            saveAmenityCategory: ['configure', 'configure', 'hospitality_core.configuration-audit'],
+            saveBed: ['configure', 'configure', 'hospitality_core.configuration-audit'],
+            saveBuilding: ['configure', 'configure', 'hospitality_core.configuration-audit'],
+            saveCancellationPolicy: [
+                'configure',
+                ['configure', 'revenue-operate'],
+                'hospitality_core.configuration-audit',
+            ],
+            saveExtraLine: ['configure', 'configure', 'hospitality_core.configuration-audit'],
+            saveFloor: ['configure', 'configure', 'hospitality_core.configuration-audit'],
+            saveGuestDocument: ['configure', 'configure', 'hospitality_core.configuration-audit'],
+            saveProperty: ['configure', 'configure', 'hospitality_core.configuration-audit'],
+            savePropertyCharge: ['configure', 'configure', 'hospitality_core.configuration-audit'],
+            savePropertyContact: ['configure', 'configure', 'hospitality_core.configuration-audit'],
+            saveRatePlan: ['configure', ['configure', 'revenue-operate'], 'hospitality_core.configuration-audit'],
+            saveRoom: ['configure', 'configure', 'hospitality_core.configuration-audit'],
+            saveRoomType: ['configure', 'configure', 'hospitality_core.configuration-audit'],
+            setInventoryRange: [
+                'configure',
+                ['configure', 'revenue-operate'],
+                'hospitality_core.configuration-audit',
+            ],
+            setPrimaryContentImage: ['configure', 'configure', 'hospitality_core.configuration-audit'],
+            setRestrictionRange: [
+                'configure',
+                ['configure', 'revenue-operate'],
+                'hospitality_core.configuration-audit',
+            ],
+            setRoomStatus: [
+                'configure',
+                ['configure', 'housekeeping-supervise'],
+                'hospitality_core.configuration-audit',
+            ],
+            startCleaningTask: ['operate', ['operate', 'housekeeping-attend']],
+            updateContentImage: ['operate', 'operate'],
+            voidCharge: ['approve', 'approve', 'hospitality_core.domain-policy'],
+        },
+        exemptions: {
+            cancelPartnerReservation: ['internal-route', 'hospitality_core.trusted-route-worker-or-service'],
+            createOnlineReservation: ['internal-route', 'hospitality_core.trusted-route-worker-or-service'],
+            getPartnerReservation: ['internal-route', 'hospitality_core.trusted-route-worker-or-service'],
+            getPropertyCatalog: ['internal-route', 'hospitality_core.trusted-route-worker-or-service'],
+            getRoomTypeCatalog: ['internal-route', 'hospitality_core.trusted-route-worker-or-service'],
+            listPartnerReservations: ['internal-route', 'hospitality_core.trusted-route-worker-or-service'],
+            listPropertyCatalog: ['internal-route', 'hospitality_core.trusted-route-worker-or-service'],
+            listRoomTypeCatalog: ['internal-route', 'hospitality_core.trusted-route-worker-or-service'],
+            quoteAvailability: ['internal-route', 'hospitality_core.trusted-route-worker-or-service'],
+        },
+    },
+    hospitality_staff_channel: {
+        posture: 'projection/bridge',
+        bundles: [],
+        functions: {},
+        exemptions: {},
+    },
+    hr: {
+        posture: 'permission-bearing',
+        bundles: ['configure', 'operate'],
+        functions: {
+            'department.save': ['configure', 'configure', 'hr.configuration-audit'],
+            'employee.create': ['configure', 'configure', 'hr.configuration-audit'],
+            'employee.manageList': ['configure', 'configure', 'hr.configuration-audit'],
+            'employee.myProfile': ['operate', 'operate'],
+            'employee.save': ['configure', 'configure', 'hr.configuration-audit'],
+            'job.save': ['configure', 'configure', 'hr.configuration-audit'],
+            'leave.manageAllocation': ['configure', 'configure', 'hr.configuration-audit'],
+            'leave.manageDecision': ['configure', 'configure', 'hr.configuration-audit'],
+            'leave.manageList': ['configure', 'configure', 'hr.configuration-audit'],
+            'leave.mine': ['operate', 'operate'],
+            'leave.request': ['operate', 'operate'],
+            'leaveType.save': ['configure', 'configure', 'hr.configuration-audit'],
+            'roster.generate': ['operate', 'operate'],
+            'roster.manageList': ['configure', 'configure', 'hr.configuration-audit'],
+            'roster.managePublish': ['configure', 'configure', 'hr.configuration-audit'],
+            'roster.manageReopen': ['configure', 'configure', 'hr.configuration-audit'],
+            'rotation.assign': ['configure', 'configure', 'hr.configuration-audit'],
+            'rotation.save': ['configure', 'configure', 'hr.configuration-audit'],
+            'schedule.mine': ['operate', 'operate'],
+            'shift.save': ['configure', 'configure', 'hr.configuration-audit'],
+            'shiftTemplate.save': ['configure', 'configure', 'hr.configuration-audit'],
+        },
+        exemptions: {},
+    },
+    inventory_staff_channel: {
+        posture: 'projection/bridge',
+        bundles: [],
+        functions: {},
+        exemptions: {},
+    },
+    livedoc: {
+        posture: 'projection/bridge',
+        bundles: [],
+        functions: {},
+        exemptions: {
+            // Both are `exposure: 'internal'`: the generic function path refuses them.
+            // The document owner's own route resolves the record and runs its read or
+            // write check first, then calls these — the same arrangement flow_backend's
+            // four commit functions use.
+            'sync.resolveSnapshotKey': ['internal-route', 'livedoc.trusted-route-worker-or-service'],
+            'sync.viewer': ['internal-route', 'livedoc.trusted-route-worker-or-service'],
+        },
+    },
+    loyalty: {
+        posture: 'permission-bearing',
+        bundles: ['approve', 'configure', 'operate', 'report', 'sensitive', 'view'],
+        functions: {
+            applyCode: ['configure', 'configure', 'loyalty.configuration-audit'],
+            applyReward: ['configure', 'configure', 'loyalty.configuration-audit'],
+            'earnGroup.list': ['read', 'view'],
+            'earnGroup.save': ['configure', 'configure', 'loyalty.configuration-audit'],
+            evaluateOrder: ['operate', 'operate'],
+            'ledger.list': ['sensitive', 'sensitive', 'loyalty.sensitive-data'],
+            'ledger.stats': ['sensitive', 'sensitive', 'loyalty.sensitive-data'],
+            'maintenance.expire': ['approve', 'approve', 'loyalty.domain-policy'],
+            'membership.config.get': ['read', 'view'],
+            'membership.config.save': ['configure', 'configure', 'loyalty.configuration-audit'],
+            'membership.getSummary': ['read', 'report'],
+            'membership.list': ['read', 'view'],
+            'membership.refresh': ['operate', 'operate'],
+            'membership.refreshAsync': ['operate', 'operate'],
+            'membership.stats': ['operate', 'operate'],
+            'order.finalize': ['approve', 'approve', 'loyalty.domain-policy'],
+            'order.reverse': ['approve', 'approve', 'loyalty.domain-policy'],
+            'order.reversePortion': ['approve', 'approve', 'loyalty.domain-policy'],
+            'portal.summary': ['operate', 'operate'],
+            'program.archive': ['configure', 'configure', 'loyalty.configuration-audit'],
+            'program.get': ['read', 'view'],
+            'program.list': ['read', 'view'],
+            'program.save': ['configure', 'configure', 'loyalty.configuration-audit'],
+            'program.setPricelists': ['configure', 'configure', 'loyalty.configuration-audit'],
+            'program.stats': ['operate', 'operate'],
+            removeReward: ['operate', 'operate'],
+            'reward.archive': ['configure', 'configure', 'loyalty.configuration-audit'],
+            'reward.save': ['configure', 'configure', 'loyalty.configuration-audit'],
+            'reward.setProducts': ['configure', 'configure', 'loyalty.configuration-audit'],
+            'rule.archive': ['configure', 'configure', 'loyalty.configuration-audit'],
+            'rule.save': ['configure', 'configure', 'loyalty.configuration-audit'],
+            'rule.setProducts': ['configure', 'configure', 'loyalty.configuration-audit'],
+            'storedValue.expire': ['approve', 'approve', 'loyalty.domain-policy'],
+            'storedValue.finalize': ['approve', 'approve', 'loyalty.domain-policy'],
+            'storedValue.issue': ['configure', 'configure', 'loyalty.configuration-audit'],
+            'storedValue.open': ['operate', 'operate'],
+            'storedValue.refund': ['approve', 'approve', 'loyalty.domain-policy'],
+            'storedValue.release': ['approve', 'approve', 'loyalty.domain-policy'],
+            'storedValue.reserve': ['operate', 'operate'],
+            'tag.assignProduct': ['configure', 'configure', 'loyalty.configuration-audit'],
+            'tag.save': ['configure', 'configure', 'loyalty.configuration-audit'],
+            'tier.list': ['read', 'view'],
+            'tier.save': ['configure', 'configure', 'loyalty.configuration-audit'],
+            'wallet.adjust': ['operate', 'operate'],
+            'wallet.create': ['operate', 'operate'],
+            'wallet.get': ['read', 'view'],
+            'wallet.list': ['read', 'view'],
+            'wallet.stats': ['operate', 'operate'],
+        },
+        exemptions: {},
+    },
+    loyalty_pos: {
+        posture: 'permission-bearing',
+        bundles: ['approve', 'configure', 'operate', 'view'],
+        functions: {
+            applyCode: ['configure', 'configure', 'loyalty_pos.configuration-audit'],
+            applyReward: ['configure', 'configure', 'loyalty_pos.configuration-audit'],
+            backfill: ['operate', 'operate'],
+            cancelOrder: ['approve', 'approve', 'loyalty_pos.domain-policy'],
+            createExchange: ['operate', 'operate'],
+            evaluateOrder: ['operate', 'operate'],
+            getOrderState: ['read', 'view'],
+            reconcileOrderAsync: ['approve', 'approve', 'loyalty_pos.domain-policy'],
+            refundOrder: ['approve', 'approve', 'loyalty_pos.domain-policy'],
+            removeReward: ['operate', 'operate'],
+            validateOrder: ['approve', 'approve', 'loyalty_pos.domain-policy'],
+        },
+        exemptions: {},
+    },
+    mail: {
+        posture: 'permission-bearing',
+        bundles: ['configure', 'operate', 'view'],
+        functions: {
+            countInbox: ['read', 'view'],
+            countUnread: ['read', 'view'],
+            listInbox: ['read', 'view'],
+            listSubtypes: ['read', 'view'],
+            markAllInboxRead: ['operate', 'operate'],
+            markInboxRead: ['operate', 'operate'],
+            saveSubtype: ['configure', 'configure', 'mail.configuration-audit'],
+        },
+        exemptions: {},
+    },
+    mail_backend: {
+        posture: 'projection/bridge',
+        bundles: [],
+        functions: {},
+        exemptions: {},
+    },
+    mail_staff_channel: {
+        posture: 'projection/bridge',
+        bundles: [],
+        functions: {},
+        exemptions: {},
+    },
+    mail_transport: {
+        posture: 'permission-bearing',
+        bundles: ['approve', 'configure', 'operate', 'sensitive', 'view'],
+        functions: {
+            cancel: ['approve', 'approve', 'mail_transport.domain-policy'],
+            listOutbox: ['read', 'view'],
+            queueTemplate: ['operate', 'operate'],
+            recordProviderEvent: ['sensitive', 'sensitive', 'mail_transport.sensitive-data'],
+            retry: ['operate', 'operate'],
+            saveTemplate: ['configure', 'configure', 'mail_transport.configuration-audit'],
+        },
+        exemptions: {},
+    },
+    manufacturing: {
+        posture: 'permission-bearing',
+        bundles: ['approve', 'configure', 'operate', 'view'],
+        functions: {
+            cancelProduction: ['approve', 'approve', 'manufacturing.domain-policy'],
+            completeProduction: ['approve', 'approve', 'manufacturing.domain-policy'],
+            confirmProduction: ['approve', 'approve', 'manufacturing.domain-policy'],
+            finishWorkOrder: ['operate', 'operate'],
+            getBom: ['read', 'view'],
+            getProduction: ['read', 'view'],
+            listBoms: ['read', 'view'],
+            listProductions: ['read', 'view'],
+            listWorkCenters: ['read', 'view'],
+            pauseWorkOrder: ['operate', 'operate'],
+            saveBom: ['configure', 'configure', 'manufacturing.configuration-audit'],
+            saveProduction: ['operate', 'operate'],
+            saveWorkCenter: ['configure', 'configure', 'manufacturing.configuration-audit'],
+            startProduction: ['operate', 'operate'],
+            startWorkOrder: ['operate', 'operate'],
+        },
+        exemptions: {},
+    },
+    manufacturing_backend: {
+        posture: 'permission-bearing',
+        bundles: [],
+        functions: {},
+        exemptions: {},
+    },
+    oauth: {
+        posture: 'session/device',
+        bundles: ['configure', 'security', 'sensitive'],
+        functions: {
+            archiveProvider: ['security', 'security', 'oauth.security-audit'],
+            getProvider: ['sensitive', 'sensitive', 'oauth.sensitive-data'],
+            linkIdentity: ['security', 'security', 'oauth.security-audit'],
+            listIdentities: ['sensitive', 'sensitive', 'oauth.sensitive-data'],
+            listProviders: ['sensitive', 'sensitive', 'oauth.sensitive-data'],
+            manageOptions: ['configure', 'configure', 'oauth.configuration-audit'],
+            saveProvider: ['security', 'security', 'oauth.security-audit'],
+            unlinkIdentity: ['security', 'security', 'oauth.security-audit'],
+        },
+        exemptions: {
+            beginTransaction: ['anonymous', 'declared-public-or-cryptographic-realm-boundary'],
+            claimTransaction: ['anonymous', 'declared-public-or-cryptographic-realm-boundary'],
+            myIdentities: ['anonymous', 'declared-public-or-cryptographic-realm-boundary'],
+            providerForLogin: ['anonymous', 'declared-public-or-cryptographic-realm-boundary'],
+            publicProviders: ['anonymous', 'declared-public-or-cryptographic-realm-boundary'],
+            resolveLogin: ['anonymous', 'declared-public-or-cryptographic-realm-boundary'],
+        },
+    },
+    oauth_backend: {
+        posture: 'projection/bridge',
+        bundles: [],
+        functions: {},
+        exemptions: {},
+    },
+    partner: {
+        posture: 'permission-bearing',
+        bundles: ['configure', 'operate', 'view'],
+        functions: {
+            archivePartner: ['configure', 'configure', 'partner.configuration-audit'],
+            archivePartners: ['configure', 'configure', 'partner.configuration-audit'],
+            countPartners: ['read', 'view'],
+            getPartner: ['read', 'view'],
+            getTerms: ['read', 'view'],
+            grantRole: ['configure', 'configure', 'partner.configuration-audit'],
+            listAddresses: ['read', 'view'],
+            listPartners: ['read', 'view'],
+            revokeRole: ['configure', 'configure', 'partner.configuration-audit'],
+            saveAddress: ['configure', 'configure', 'partner.configuration-audit'],
+            savePartner: ['configure', 'configure', 'partner.configuration-audit'],
+            saveTerms: ['configure', 'configure', 'partner.configuration-audit'],
+            snapshotAddress: ['operate', 'operate'],
+        },
+        exemptions: {},
+    },
+    partner_backend: {
+        posture: 'projection/bridge',
+        bundles: [],
+        functions: {},
+        exemptions: {},
+    },
+    partner_mail_backend: {
+        posture: 'projection/bridge',
+        bundles: ['approve', 'operate'],
+        functions: {
+            follow: ['operate', 'operate'],
+            post: ['approve', 'approve', 'partner_mail_backend.domain-policy'],
+            timeline: ['operate', 'operate'],
+            unfollow: ['operate', 'operate'],
+        },
+        exemptions: {},
+    },
+    pos: {
+        posture: 'permission-bearing',
+        bundles: [
+            'cash-control',
+            'configure',
+            'order-operate',
+            'reconcile',
+            'refund',
+            'sensitive',
+            'shift-approve',
+            'shift-operate',
+            'tender',
+            'view',
+            'void',
+        ],
+        functions: {
+            addLine: ['operate', 'order-operate'],
+            addPayment: ['operate', 'tender'],
+            approveSessionVariance: ['approve', 'shift-approve', 'pos.domain-policy'],
+            cancelOrder: ['approve', 'void', 'pos.domain-policy'],
+            closeSession: ['approve', 'shift-approve', 'pos.domain-policy'],
+            createExchange: ['operate', 'order-operate'],
+            createOrder: ['operate', 'order-operate'],
+            createSession: ['configure', 'configure', 'pos.configuration-audit'],
+            getLineTrackingAvailability: ['read', 'view'],
+            getOrder: ['read', 'view'],
+            getReceipt: ['read', 'view'],
+            getReturnEligibility: ['read', 'view'],
+            getSession: ['read', 'view'],
+            linkPaymentMethod: ['configure', 'configure', 'pos.configuration-audit'],
+            listAuditEvents: ['sensitive', 'sensitive', 'pos.sensitive-data'],
+            listConfigs: ['read', 'view'],
+            listOrders: ['read', 'view'],
+            listPaymentMethods: ['read', 'view'],
+            listSessions: ['read', 'view'],
+            openSession: ['operate', 'shift-operate'],
+            operationsReport: ['sensitive', 'sensitive', 'pos.sensitive-data'],
+            paymentMethodAvailable: ['operate', 'tender'],
+            recordCashMovement: ['operate', 'cash-control', 'pos.cash-control-policy'],
+            recountSession: ['operate', 'shift-operate'],
+            refundOrder: ['approve', 'refund', 'pos.domain-policy'],
+            removeLine: ['operate', 'order-operate'],
+            reorderLines: ['operate', 'order-operate'],
+            reverseCashMovement: ['approve', 'cash-control', 'pos.cash-control-policy'],
+            saveConfig: ['configure', 'configure', 'pos.configuration-audit'],
+            savePaymentMethod: ['configure', 'configure', 'pos.configuration-audit'],
+            setLineLotSelections: ['configure', 'configure', 'pos.configuration-audit'],
+            startClosing: ['operate', 'shift-operate'],
+            updateLine: ['operate', 'order-operate'],
+            updateOrder: ['operate', 'order-operate'],
+            validateOrder: ['approve', 'reconcile', 'pos.domain-policy'],
+            voidPayment: ['approve', 'void', 'pos.domain-policy'],
+        },
+        exemptions: {
+            lockProviderPayment: ['internal-route', 'pos.trusted-route-worker-or-service'],
+            reverseProviderPayment: ['internal-route', 'pos.trusted-route-worker-or-service'],
+            reviewProviderPayment: ['internal-route', 'pos.trusted-route-worker-or-service'],
+            settleProviderPayment: ['internal-route', 'pos.trusted-route-worker-or-service'],
+            unlockProviderPayment: ['internal-route', 'pos.trusted-route-worker-or-service'],
+        },
+    },
+    pos_backend: {
+        posture: 'projection/bridge',
+        bundles: [],
+        functions: {},
+        exemptions: {},
+    },
+    pos_channel: {
+        posture: 'projection/bridge',
+        bundles: [],
+        functions: {},
+        exemptions: {
+            claimSyncCommand: ['internal-route', 'pos_channel.trusted-route-worker-or-service'],
+            completeSyncCommand: ['internal-route', 'pos_channel.trusted-route-worker-or-service'],
+            getSyncCommand: ['internal-route', 'pos_channel.trusted-route-worker-or-service'],
+            listDeviceSyncCommands: ['internal-route', 'pos_channel.trusted-route-worker-or-service'],
+            priceBook: ['internal-route', 'pos_channel.trusted-route-worker-or-service'],
+        },
+    },
+    pricing: {
+        posture: 'permission-bearing',
+        bundles: ['configure', 'operate', 'view'],
+        functions: {
+            listPricelistItems: ['read', 'view'],
+            listPricelists: ['read', 'view'],
+            priceFor: ['operate', 'operate'],
+            savePricelist: ['configure', 'configure', 'pricing.configuration-audit'],
+            savePricelistItem: ['configure', 'configure', 'pricing.configuration-audit'],
+        },
+        exemptions: {},
+    },
+    product: {
+        posture: 'permission-bearing',
+        bundles: ['configure', 'operate', 'report', 'view'],
+        functions: {
+            addProductUom: ['operate', 'operate'],
+            addTemplateUom: ['operate', 'operate'],
+            archiveTemplate: ['configure', 'configure', 'product.configuration-audit'],
+            countTemplates: ['read', 'view'],
+            deleteTemplates: ['configure', 'configure', 'product.configuration-audit'],
+            generateVariants: ['operate', 'operate'],
+            getTemplate: ['read', 'view'],
+            getVariant: ['read', 'view'],
+            getVariantSummary: ['read', 'report'],
+            groupTemplates: ['operate', 'operate'],
+            listAttributeLines: ['read', 'view'],
+            listAttributes: ['read', 'view'],
+            listAttributeValues: ['read', 'view'],
+            listBrands: ['read', 'view'],
+            listCategories: ['read', 'view'],
+            listTemplates: ['read', 'view'],
+            listVariantCosts: ['read', 'view'],
+            listVariants: ['read', 'view'],
+            removeAttributeLine: ['configure', 'configure', 'product.configuration-audit'],
+            saveAttribute: ['configure', 'configure', 'product.configuration-audit'],
+            saveAttributeLine: ['configure', 'configure', 'product.configuration-audit'],
+            saveAttributeValue: ['configure', 'configure', 'product.configuration-audit'],
+            saveBrand: ['configure', 'configure', 'product.configuration-audit'],
+            saveCategory: ['configure', 'configure', 'product.configuration-audit'],
+            saveTemplate: ['configure', 'configure', 'product.configuration-audit'],
+            saveVariant: ['configure', 'configure', 'product.configuration-audit'],
+            setCost: ['configure', 'configure', 'product.configuration-audit'],
+            setProductUom: ['configure', 'configure', 'product.configuration-audit'],
+        },
+        exemptions: {},
+    },
+    product_backend: {
+        posture: 'projection/bridge',
+        bundles: [],
+        functions: {},
+        exemptions: {},
+    },
+    product_mail_backend: {
+        posture: 'projection/bridge',
+        bundles: ['approve', 'operate'],
+        functions: {
+            follow: ['operate', 'operate'],
+            post: ['approve', 'approve', 'product_mail_backend.domain-policy'],
+            timeline: ['operate', 'operate'],
+            unfollow: ['operate', 'operate'],
+        },
+        exemptions: {},
+    },
+    product_media: {
+        posture: 'permission-bearing',
+        bundles: ['configure', 'operate', 'view'],
+        functions: {
+            attachMedia: ['operate', 'operate'],
+            listMedia: ['read', 'view'],
+            listMediaByProducts: ['read', 'view'],
+            listPrimaryMedia: ['read', 'view'],
+            removeMedia: ['operate', 'operate'],
+            reorderMedia: ['operate', 'operate'],
+            setPrimary: ['configure', 'configure', 'product_media.configuration-audit'],
+        },
+        exemptions: {},
+    },
+    purchase: {
+        posture: 'permission-bearing',
+        bundles: ['approve', 'configure', 'operate', 'report', 'sensitive', 'view'],
+        functions: {
+            addLine: ['operate', 'operate'],
+            approveOrder: ['approve', 'approve', 'purchase.domain-policy'],
+            cancelOrder: ['approve', 'approve', 'purchase.domain-policy'],
+            confirmOrder: ['approve', 'approve', 'purchase.domain-policy'],
+            createOrder: ['operate', 'operate'],
+            createVendorBill: ['configure', 'configure', 'purchase.configuration-audit'],
+            getOrder: ['read', 'view'],
+            getPurchaseOrderReport: ['sensitive', 'sensitive', 'purchase.sensitive-data'],
+            getRfqReport: ['sensitive', 'sensitive', 'purchase.sensitive-data'],
+            listOrderMetrics: ['read', 'report'],
+            listOrders: ['read', 'view'],
+            listSupplierInfo: ['read', 'view'],
+            lockOrder: ['approve', 'approve', 'purchase.domain-policy'],
+            receiveOrderReceipt: ['operate', 'operate'],
+            removeLine: ['operate', 'operate'],
+            resetToDraft: ['operate', 'operate'],
+            saveDraft: ['configure', 'configure', 'purchase.configuration-audit'],
+            saveSupplierInfo: ['configure', 'configure', 'purchase.configuration-audit'],
+            sendRfq: ['operate', 'operate'],
+            setPurchaseMethod: ['configure', 'configure', 'purchase.configuration-audit'],
+            syncReceipts: ['operate', 'operate'],
+            updateLine: ['operate', 'operate'],
+        },
+        exemptions: {},
+    },
+    purchase_backend: {
+        posture: 'projection/bridge',
+        bundles: [],
+        functions: {},
+        exemptions: {},
+    },
+    purchase_staff_channel: {
+        posture: 'projection/bridge',
+        bundles: [],
+        functions: {},
+        exemptions: {},
+    },
+    quality: {
+        posture: 'permission-bearing',
+        bundles: ['approve', 'configure', 'operate', 'view'],
+        functions: {
+            createRequirement: ['configure', 'configure', 'quality.configuration-audit'],
+            getCheck: ['read', 'view'],
+            saveTemplate: ['configure', 'configure', 'quality.configuration-audit'],
+            submit: ['approve', 'approve', 'quality.domain-policy'],
+            uploadPhoto: ['operate', 'operate'],
+        },
+        exemptions: {},
+    },
+    quality_staff_channel: {
+        posture: 'projection/bridge',
+        bundles: [],
+        functions: {},
+        exemptions: {},
+    },
+    sale: {
+        posture: 'permission-bearing',
+        bundles: [
+            'cancel',
+            'configure',
+            'confirm',
+            'fulfillment-sync',
+            'invoice',
+            'quote-operate',
+            'report',
+            'view',
+        ],
+        functions: {
+            addLine: ['operate', 'quote-operate'],
+            cancelOrder: ['approve', 'cancel', 'sale.domain-policy'],
+            confirmOrder: ['approve', 'confirm', 'sale.domain-policy'],
+            countOrders: ['read', 'view'],
+            createInvoice: ['approve', 'invoice', 'sale.domain-policy'],
+            createOrder: ['operate', 'quote-operate'],
+            getOrder: ['read', 'view'],
+            getProformaReport: ['sensitive', 'report', 'sale.sensitive-data'],
+            getQuotationReport: ['sensitive', 'report', 'sale.sensitive-data'],
+            getSalesOrderReport: ['sensitive', 'report', 'sale.sensitive-data'],
+            listInvoicePolicies: ['read', 'view'],
+            listOrders: ['read', 'view'],
+            lockOrder: ['approve', 'confirm', 'sale.domain-policy'],
+            removeLine: ['operate', 'quote-operate'],
+            resetOrder: ['operate', 'quote-operate'],
+            saveDraft: ['operate', 'quote-operate'],
+            sendQuotation: ['operate', 'quote-operate'],
+            setInvoicePolicy: ['configure', 'configure', 'sale.configuration-audit'],
+            syncDeliveries: ['operate', 'fulfillment-sync'],
+        },
+        exemptions: {},
+    },
+    sale_backend: {
+        posture: 'projection/bridge',
+        bundles: [],
+        functions: {},
+        exemptions: {},
+    },
+    sale_staff_channel: {
+        posture: 'projection/bridge',
+        bundles: [],
+        functions: {},
+        exemptions: {},
+    },
+    stock: {
+        posture: 'permission-bearing',
+        bundles: ['approve', 'configure', 'operate', 'report', 'sensitive', 'view'],
+        functions: {
+            addMove: ['operate', 'operate'],
+            adjustInventory: ['operate', 'operate'],
+            assignCategoryRoute: ['configure', 'configure', 'stock.configuration-audit'],
+            assignPicking: ['operate', 'operate'],
+            assignProductRoute: ['configure', 'configure', 'stock.configuration-audit'],
+            assignWarehouseRoute: ['configure', 'configure', 'stock.configuration-audit'],
+            cancelPicking: ['approve', 'approve', 'stock.domain-policy'],
+            completePicking: ['approve', 'approve', 'stock.domain-policy'],
+            configureProduct: ['operate', 'operate'],
+            confirmPicking: ['approve', 'approve', 'stock.domain-policy'],
+            createLot: ['configure', 'configure', 'stock.configuration-audit'],
+            createPicking: ['operate', 'operate'],
+            forecast: ['read', 'report'],
+            getDeliveryReport: ['sensitive', 'sensitive', 'stock.sensitive-data'],
+            getInternalTransferReport: ['sensitive', 'sensitive', 'stock.sensitive-data'],
+            getPicking: ['read', 'view'],
+            getPickingView: ['read', 'view'],
+            getProductConfig: ['read', 'view'],
+            getProductStockView: ['read', 'view'],
+            getReceiptReport: ['sensitive', 'sensitive', 'stock.sensitive-data'],
+            listLocations: ['read', 'view'],
+            listLots: ['read', 'view'],
+            listOrderpoints: ['read', 'view'],
+            listPickings: ['read', 'view'],
+            listPickingTypes: ['read', 'view'],
+            listPickingViews: ['read', 'view'],
+            listProductAvailability: ['read', 'view'],
+            listProductConfigs: ['read', 'view'],
+            listQuants: ['read', 'view'],
+            listRoutes: ['read', 'view'],
+            listRules: ['read', 'view'],
+            listStorableProducts: ['read', 'view'],
+            listWarehouses: ['read', 'view'],
+            procure: ['operate', 'operate'],
+            reconcileReservations: ['approve', 'approve', 'stock.domain-policy'],
+            reserveMove: ['operate', 'operate'],
+            reserveMoves: ['operate', 'operate'],
+            runOrderpoint: ['operate', 'operate'],
+            runOrderpoints: ['operate', 'operate'],
+            saveInventoryProduct: ['configure', 'configure', 'stock.configuration-audit'],
+            saveLocation: ['configure', 'configure', 'stock.configuration-audit'],
+            saveLot: ['configure', 'configure', 'stock.configuration-audit'],
+            saveMoveLine: ['operate', 'operate'],
+            saveOrderpoint: ['operate', 'operate'],
+            savePicking: ['operate', 'operate'],
+            savePickingType: ['operate', 'operate'],
+            saveRoute: ['configure', 'configure', 'stock.configuration-audit'],
+            saveRule: ['configure', 'configure', 'stock.configuration-audit'],
+            saveWarehouse: ['configure', 'configure', 'stock.configuration-audit'],
+            setInventoryProductActive: ['configure', 'configure', 'stock.configuration-audit'],
+            trackedAvailability: ['operate', 'operate'],
+            validatePicking: ['approve', 'approve', 'stock.domain-policy'],
+        },
+        exemptions: {
+            deleteInventoryProduct: ['internal-route', 'stock.trusted-route-worker-or-service'],
+        },
+    },
+    stock_backend: {
+        posture: 'projection/bridge',
+        bundles: [],
+        functions: {},
+        exemptions: {},
+    },
+    stock_mail_backend: {
+        posture: 'projection/bridge',
+        bundles: ['approve', 'operate'],
+        functions: {
+            follow: ['operate', 'operate'],
+            post: ['approve', 'approve', 'stock_mail_backend.domain-policy'],
+            timeline: ['operate', 'operate'],
+            unfollow: ['operate', 'operate'],
+        },
+        exemptions: {},
+    },
+    stock_staff_channel: {
+        posture: 'projection/bridge',
+        bundles: ['approve', 'configure', 'operate', 'view'],
+        functions: {
+            claimCountSession: ['operate', 'operate'],
+            claimPicking: ['operate', 'operate'],
+            completeExecution: ['approve', 'approve', 'stock_staff_channel.domain-policy'],
+            completeGuidedPicking: ['approve', 'approve', 'stock_staff_channel.domain-policy'],
+            completeReturnExecution: ['approve', 'approve', 'stock_staff_channel.domain-policy'],
+            createCountSession: ['configure', 'configure', 'stock_staff_channel.configuration-audit'],
+            getCountContext: ['read', 'view'],
+            getScanContext: ['read', 'view'],
+            listActiveClaims: ['read', 'view'],
+            listCountSessions: ['read', 'view'],
+            recordCountLine: ['operate', 'operate'],
+            releasePicking: ['approve', 'approve', 'stock_staff_channel.domain-policy'],
+            resumeCountAttempt: ['operate', 'operate'],
+            startScanSession: ['operate', 'operate'],
+            submitCountAttempt: ['approve', 'approve', 'stock_staff_channel.domain-policy'],
+            submitScanEvent: ['approve', 'approve', 'stock_staff_channel.domain-policy'],
+            transitionScanSession: ['approve', 'approve', 'stock_staff_channel.domain-policy'],
+        },
+        exemptions: {},
+    },
+    storage: {
+        posture: 'permission-bearing',
+        bundles: ['operate', 'view'],
+        functions: {
+            createAttachment: ['operate', 'operate'],
+            getAttachment: ['read', 'view'],
+            listAttachments: ['read', 'view'],
+            removeAttachment: ['operate', 'operate'],
+            requestSweep: ['operate', 'operate'],
+        },
+        exemptions: {
+            getPublicAttachment: ['anonymous', 'declared-public-or-cryptographic-realm-boundary'],
+        },
+    },
+    uom: {
+        posture: 'permission-bearing',
+        bundles: ['approve', 'configure', 'operate', 'view'],
+        functions: {
+            convert: ['operate', 'operate'],
+            listUnits: ['read', 'view'],
+            lockUnit: ['approve', 'approve', 'uom.domain-policy'],
+            savePrecision: ['configure', 'configure', 'uom.configuration-audit'],
+            saveUnit: ['configure', 'configure', 'uom.configuration-audit'],
+        },
+        exemptions: {},
+    },
+    user: {
+        posture: 'permission-bearing',
+        bundles: ['security', 'sensitive'],
+        functions: {
+            applyPreset: ['security', 'security', 'user.security-audit'],
+            applyRoleTemplate: ['security', 'security', 'user.security-audit'],
+            archiveBranch: ['security', 'security', 'user.security-audit'],
+            archiveCompany: ['security', 'security', 'user.security-audit'],
+            archiveUser: ['security', 'security', 'user.security-audit'],
+            assignRole: ['security', 'security', 'user.security-audit'],
+            assignScopedRole: ['security', 'security', 'user.security-audit'],
+            authorizationState: ['sensitive', 'sensitive', 'user.sensitive-data'],
+            cloneManagedRole: ['security', 'security', 'user.security-audit'],
+            createUser: ['security', 'security', 'user.security-audit'],
+            effectiveAccess: ['sensitive', 'sensitive', 'user.sensitive-data'],
+            getRole: ['sensitive', 'sensitive', 'user.sensitive-data'],
+            getUser: ['sensitive', 'sensitive', 'user.sensitive-data'],
+            grantBranch: ['security', 'security', 'user.security-audit'],
+            grantCompany: ['security', 'security', 'user.security-audit'],
+            grantFunction: ['security', 'security', 'user.security-audit'],
+            listAuthorizationAudit: ['sensitive', 'sensitive', 'user.sensitive-data'],
+            listRoles: ['sensitive', 'sensitive', 'user.sensitive-data'],
+            listSecurityAudit: ['sensitive', 'sensitive', 'user.sensitive-data'],
+            listUsers: ['sensitive', 'sensitive', 'user.sensitive-data'],
+            permissionBundleCatalogue: ['sensitive', 'sensitive', 'user.sensitive-data'],
+            permissionCatalogue: ['security', 'security', 'user.security-audit'],
+            permitted: ['sensitive', 'sensitive', 'user.sensitive-data'],
+            previewRoleTemplate: ['sensitive', 'sensitive', 'user.sensitive-data'],
+            revokeBranch: ['security', 'security', 'user.security-audit'],
+            revokeCompany: ['security', 'security', 'user.security-audit'],
+            revokeFunction: ['security', 'security', 'user.security-audit'],
+            saveRole: ['security', 'security', 'user.security-audit'],
+            saveUser: ['security', 'security', 'user.security-audit'],
+            setBreakGlass: ['security', 'security', 'user.security-audit'],
+            setDefaultContext: ['security', 'security', 'user.security-audit'],
+            unassignRole: ['security', 'security', 'user.security-audit'],
+            unassignScopedRole: ['security', 'security', 'user.security-audit'],
+        },
+        exemptions: {
+            authenticate: ['anonymous', 'declared-public-or-cryptographic-realm-boundary'],
+            consumeAuthToken: ['anonymous', 'declared-public-or-cryptographic-realm-boundary'],
+            contextOptions: ['anonymous', 'declared-public-or-cryptographic-realm-boundary'],
+            issueAuthToken: ['internal-route', 'user.trusted-route-worker-or-service'],
+            prepareContext: ['anonymous', 'declared-public-or-cryptographic-realm-boundary'],
+            provisionAdmin: ['bootstrap-only', 'operator-provisioning-boundary'],
+            recordSecurityEvent: ['anonymous', 'declared-public-or-cryptographic-realm-boundary'],
+            resolveSessionContext: ['internal-route', 'user.trusted-route-worker-or-service'],
+            setPassword: ['anonymous', 'declared-public-or-cryptographic-realm-boundary'],
+            setTimezone: ['internal-route', 'user.trusted-route-worker-or-service'],
+        },
+    },
+    user_backend: {
+        posture: 'projection/bridge',
+        bundles: [],
+        functions: {},
+        exemptions: {},
+    },
+    website_form: {
+        posture: 'permission-bearing',
+        bundles: ['configure', 'operate', 'security', 'sensitive', 'view'],
+        functions: {
+            countSubmissions: ['read', 'view'],
+            exportSubmissions: ['sensitive', 'sensitive', 'website.sensitive-data'],
+            holdSubmission: ['operate', 'operate'],
+            listForms: ['read', 'view'],
+            listSubmissionAudit: ['sensitive', 'sensitive', 'website.sensitive-data'],
+            listSubmissions: ['read', 'view'],
+            purgeSubmissions: ['security', 'security', 'website.security-audit'],
+            readSubmission: ['sensitive', 'sensitive', 'website.sensitive-data'],
+            saveForm: ['configure', 'configure', 'website.configuration-audit'],
+        },
+        exemptions: {
+            getForm: ['anonymous', 'declared-public-or-cryptographic-realm-boundary'],
+            submitForm: ['internal-route', 'website_form.public-submit-route'],
+        },
+    },
+    website_form_mail: {
+        posture: 'projection/bridge',
+        bundles: ['operate'],
+        functions: {
+            notifySubmission: ['operate', 'operate'],
+        },
+        exemptions: {},
+    },
+    website_menu: {
+        posture: 'permission-bearing',
+        bundles: ['configure', 'view'],
+        functions: {
+            addMenuItem: ['configure', 'configure', 'website.configuration-audit'],
+            listMenu: ['read', 'view'],
+            preflightMenu: ['read', 'view'],
+            moveMenuItem: ['configure', 'configure', 'website.configuration-audit'],
+            removeMenuItem: ['configure', 'configure', 'website.configuration-audit'],
+            snapshotMenu: ['configure', 'configure', 'website.configuration-audit'],
+        },
+        exemptions: {
+            publicMenu: ['anonymous', 'declared-public-or-cryptographic-realm-boundary'],
+        },
+    },
+    website_search: {
+        posture: 'permission-bearing',
+        bundles: ['operate', 'view'],
+        functions: {
+            indexStatus: ['read', 'view'],
+            reindexSite: ['operate', 'operate'],
+        },
+        exemptions: {
+            searchIndexed: ['anonymous', 'declared-public-or-cryptographic-realm-boundary'],
+        },
+    },
+    website_seo: {
+        posture: 'permission-bearing',
+        bundles: ['configure', 'view'],
+        functions: {
+            getEntrySeo: ['read', 'view'],
+            saveEntrySeo: ['configure', 'configure', 'website.configuration-audit'],
+        },
+        exemptions: {
+            sitemapEntries: ['internal-route', 'website_seo.public-sitemap-route'],
+        },
+    },
+    website: {
+        posture: 'permission-bearing',
+        bundles: ['configure', 'operate', 'security', 'sensitive', 'view'],
+        functions: {
+            assignTerm: ['configure', 'configure', 'website.configuration-audit'],
+            countEntries: ['read', 'view'],
+            countPages: ['read', 'view'],
+            createPreviewToken: ['sensitive', 'sensitive', 'website.sensitive-data'],
+            deleteMediaMetadata: ['configure', 'configure', 'website.configuration-audit'],
+            deleteDomain: ['configure', 'configure', 'website.configuration-audit'],
+            deleteTerm: ['configure', 'configure', 'website.configuration-audit'],
+            diffRevisions: ['read', 'view'],
+            getEntry: ['read', 'view'],
+            getMediaMetadata: ['read', 'view'],
+            getTaxonomyTerm: ['read', 'view'],
+            listDomains: ['read', 'view'],
+            listEntries: ['read', 'view'],
+            listEntryTerms: ['read', 'view'],
+            listMedia: ['read', 'view'],
+            listPages: ['read', 'view'],
+            mediaUsage: ['read', 'view'],
+            listRedirects: ['read', 'view'],
+            listRevisions: ['read', 'view'],
+            listSiteMembers: ['read', 'view'],
+            listSites: ['read', 'view'],
+            listTaxonomyTerms: ['read', 'view'],
+            activatePublication: ['configure', 'configure', 'website.configuration-audit'],
+            listPublications: ['read', 'view'],
+            preflightPublication: ['read', 'view'],
+            preparePublication: ['configure', 'configure', 'website.configuration-audit'],
+            publishEntry: ['configure', 'configure', 'website.configuration-audit'],
+            rollbackPublication: ['configure', 'configure', 'website.configuration-audit'],
+            publishPage: ['configure', 'configure', 'website.configuration-audit'],
+            removeSiteMember: ['security', 'security', 'website.security-audit'],
+            restoreRevision: ['operate', 'operate'],
+            unpublishEntry: ['configure', 'configure', 'website.configuration-audit'],
+            revokePreviewTokens: ['sensitive', 'sensitive', 'website.sensitive-data'],
+            saveDomain: ['configure', 'configure', 'website.configuration-audit'],
+            saveEntry: ['configure', 'configure', 'website.configuration-audit'],
+            saveMediaMetadata: ['configure', 'configure', 'website.configuration-audit'],
+            savePage: ['configure', 'configure', 'website.configuration-audit'],
+            saveRedirect: ['configure', 'configure', 'website.configuration-audit'],
+            saveSite: ['configure', 'configure', 'website.configuration-audit'],
+            saveSiteMember: ['configure', 'configure', 'website.configuration-audit'],
+            saveTerm: ['configure', 'configure', 'website.configuration-audit'],
+            trashEntry: ['configure', 'configure', 'website.configuration-audit'],
+            unassignTerm: ['configure', 'configure', 'website.configuration-audit'],
+            untrashEntry: ['configure', 'configure', 'website.configuration-audit'],
+        },
+        exemptions: {
+            authenticateCustomer: ['anonymous', 'declared-public-or-cryptographic-realm-boundary'],
+            changeCustomerPassword: ['anonymous', 'declared-public-or-cryptographic-realm-boundary'],
+            claimChannelRateSlot: ['anonymous', 'declared-public-or-cryptographic-realm-boundary'],
+            customerRealmByKey: ['anonymous', 'declared-public-or-cryptographic-realm-boundary'],
+            customerRealmForSite: ['anonymous', 'declared-public-or-cryptographic-realm-boundary'],
+            getEntryByPath: ['anonymous', 'declared-public-or-cryptographic-realm-boundary'],
+            getPageByPath: ['anonymous', 'declared-public-or-cryptographic-realm-boundary'],
+            issueCustomerTokenGrant: ['anonymous', 'declared-public-or-cryptographic-realm-boundary'],
+            previewEntry: ['anonymous', 'declared-public-or-cryptographic-realm-boundary'],
+            primaryCustomerSiteForRealm: ['anonymous', 'declared-public-or-cryptographic-realm-boundary'],
+            registerCustomer: ['anonymous', 'declared-public-or-cryptographic-realm-boundary'],
+            resolveCustomerAccessToken: ['anonymous', 'declared-public-or-cryptographic-realm-boundary'],
+            resolveCustomerSession: ['anonymous', 'declared-public-or-cryptographic-realm-boundary'],
+            resolveSite: ['anonymous', 'declared-public-or-cryptographic-realm-boundary'],
+            revokeAllCustomerSessions: ['anonymous', 'declared-public-or-cryptographic-realm-boundary'],
+            revokeCustomerSession: ['anonymous', 'declared-public-or-cryptographic-realm-boundary'],
+            revokeCustomerTokenGrant: ['anonymous', 'declared-public-or-cryptographic-realm-boundary'],
+            rotateCustomerTokenGrant: ['anonymous', 'declared-public-or-cryptographic-realm-boundary'],
+            activePublication: ['anonymous', 'declared-public-or-cryptographic-realm-boundary'],
+            countSearchPublished: ['anonymous', 'declared-public-or-cryptographic-realm-boundary'],
+            searchPublished: ['anonymous', 'declared-public-or-cryptographic-realm-boundary'],
+            startCustomerSession: ['anonymous', 'declared-public-or-cryptographic-realm-boundary'],
+            updateCustomerProfile: ['anonymous', 'declared-public-or-cryptographic-realm-boundary'],
+        },
+    },
+};
+const capabilityLabels = {
+    'agent-operate': { en: 'Agent operations', vi: 'Nghiệp vụ nhân viên' },
+    analytics: { en: 'Analytics', vi: 'Phân tích' },
+    approve: { en: 'Approve', vi: 'Phê duyệt' },
+    author: { en: 'Write documents', vi: 'Soạn nội dung' },
+    assignment: { en: 'Assign records', vi: 'Phân công hồ sơ' },
+    cancel: { en: 'Cancel', vi: 'Hủy' },
+    'cash-control': { en: 'Cash control', vi: 'Kiểm soát tiền mặt' },
+    'compliance-operate': { en: 'Hospitality compliance', vi: 'Tuân thủ lưu trú' },
+    configure: { en: 'Configure', vi: 'Cấu hình' },
+    confirm: { en: 'Confirm', vi: 'Xác nhận' },
+    'fulfillment-sync': { en: 'Synchronize fulfillment', vi: 'Đồng bộ thực hiện đơn' },
+    'housekeeping-attend': { en: 'Attend housekeeping', vi: 'Thực hiện buồng phòng' },
+    'housekeeping-supervise': { en: 'Supervise housekeeping', vi: 'Giám sát buồng phòng' },
+    invoice: { en: 'Invoice', vi: 'Lập hóa đơn' },
+    merge: { en: 'Merge records', vi: 'Gộp hồ sơ' },
+    'night-audit': { en: 'Run night audit', vi: 'Chạy kiểm toán đêm' },
+    'order-operate': { en: 'Operate orders', vi: 'Vận hành đơn hàng' },
+    operate: { en: 'Operate', vi: 'Vận hành' },
+    // Not "read every project" — that is the grant row this capability hands out,
+    // and holding the capability without a row of your own reads nothing. The
+    // label said otherwise, which would have told a role screen that ticking this
+    // box opens the projects; it opens the ability to open them for somebody.
+    'project-access': { en: 'Administer project access', vi: 'Quản trị quyền đọc dự án' },
+    'project-delete': { en: 'Delete projects for good', vi: 'Xóa hẳn dự án' },
+    'property-reference': { en: 'Reference properties', vi: 'Tham chiếu cơ sở lưu trú' },
+    reconcile: { en: 'Reconcile', vi: 'Đối soát' },
+    refund: { en: 'Refund', vi: 'Hoàn tiền' },
+    report: { en: 'Reports', vi: 'Báo cáo' },
+    'reservation-input': { en: 'Enter reservations', vi: 'Nhập đặt phòng' },
+    'revenue-operate': { en: 'Manage hospitality revenue', vi: 'Quản lý doanh thu lưu trú' },
+    'quote-operate': { en: 'Operate quotations', vi: 'Vận hành báo giá' },
+    security: { en: 'Security', vi: 'Bảo mật' },
+    sensitive: { en: 'Sensitive data', vi: 'Dữ liệu nhạy cảm' },
+    'shift-approve': { en: 'Approve shifts', vi: 'Duyệt ca' },
+    'shift-operate': { en: 'Operate shifts', vi: 'Vận hành ca' },
+    tender: { en: 'Take payment', vi: 'Nhận thanh toán' },
+    view: { en: 'View', vi: 'Xem' },
+    void: { en: 'Void', vi: 'Hủy thanh toán' },
+};
+/** Exact Wave 2 declarations for public KetSuite modules in production product deployments. */
+export const ketsuitePermissionModules = Object.fromEntries(Object.entries(sources).map(([module, source]) => [
+    module,
+    {
+        posture: source.posture,
+        owner: module,
+        bundles: Object.fromEntries(source.bundles.map((capability) => {
+            const labels = capabilityLabels[capability];
+            if (!labels)
+                throw new Error(`missing labels for permission capability "${capability}"`);
+            return [
+                `${module}.${capability}`,
+                {
+                    labels: {
+                        en: `${labels.en} · ${module.replaceAll('_', ' ')}`,
+                        vi: `${labels.vi} · ${module.replaceAll('_', ' ')}`,
+                    },
+                },
+            ];
+        })),
+        functions: Object.fromEntries(Object.entries(source.functions).map(([action, [risk, capabilities, policy]]) => [
+            `${module}.${action}`,
+            {
+                risk,
+                bundles: (Array.isArray(capabilities) ? capabilities : [capabilities]).map((capability) => `${module}.${capability}`),
+                owner: module,
+                ...(policy ? { policy } : {}),
+            },
+        ])),
+        exemptions: Object.fromEntries(Object.entries(source.exemptions).map(([action, [reason, authority]]) => [
+            `${module}.${action}`,
+            { reason, authority },
+        ])),
+    },
+]));
+export const ketsuitePermissionModuleNames = Object.freeze(Object.keys(sources));
+//# sourceMappingURL=permission-catalogue.js.map