Roles

Six roles, each with a minimum for every class of action:

Role	May
Viewer	read everything, change nothing
Operator	decide on items; start and stop work
Asset Owner	Operator, for the cells they own
Steward	edit rules, prompts and stage wording
Admin	edit manifests and files; manage users and governance
Human	everything, including accounts, seats, keys and the switches

What this build does, and what it does not. The window on the machine is always the Human: the operating-system user at the engine's socket is the credential, so everything done from the window is done as the Human. People are added under Settings › Users with an email, a role and the cells they may see, and the permission matrix there shows what each role may and may not do. But this build has no way for a second person to sign in — there is no single sign-on yet — so nobody is held to a role today: a person you add is recorded, not admitted. Signing in with Google or Microsoft (OpenID Connect) is not in this release.

App keys are the one place a narrower authority exists now: a key is minted read-only or read-write, and a write needs the same step-up code the window does.

Adding users and roles is part of Pro.