Roles and operation permissions

Separate admission from business guards

When
 # Approve a pending request.
 scenario approve(request:Request) by=members
  require request.status==pending message="Request cannot be approved"
  do
   set request {status=approved}

This is a fragment requiring a declared Request schema and authorized read/write context. Membership permits reaching the operation, while the business guard determines whether this request is approvable. Operation exposure is separately controlled by CRUD exposure and selected UI/tool declarations; hiding a control is not a permission rule. An omitted CRUD exposure allows enabled generated CRUD; an explicit exposure allowlist constrains public interfaces without disabling internal canonical calls.

See authentication and teams, field access, and actions and invocations.