Roles & Permissions

Define what each role can do across modules. Resource-level scoping (for example, Sales sees only records where sales_id = current_user.id) is enforced server-side and cannot be edited here.