How rights work

Each row is a screen, menu item, or button across the apps. Check a role to grant it.
• No roles checked = Open — visible to everyone (the default).
• One or more checked = Restricted — visible only to the checked roles.
Changes save instantly. Apps enforce this by tagging elements with data-perm and reading /perms/me (rollout in progress).