One sign-in opens the platform; these grants decide which of the three apps an
account can actually use, and what it may do inside them. Changes take effect on
that person’s next request — no sign-out, no token refresh.
Every change is written to brash.activity.
| Account | Role | Apps |
|---|
Roles
viewer — read only. editor — may write operational
records. finance — adds money visibility (cost rates, invoices,
expenses, POs). admin — adds configuration and this screen.
One role applies across every app the account holds.
A new account
Create it under Authentication in Supabase. It is auto-provisioned here as
viewer with no apps, so it can sign in and see nothing until granted.
Intelligence
Terminal keeps its own module grants on top of this one. The intel app
grant is the door; which modules a person sees inside is set in the Edition’s own
Access tab.