Named permissions on every route, approval by a second person, Core role mapping in the UI
- Every API route now checks a named permission instead of a rank tier. New permissions: brd.view, frd.view, frd.generate, plan.view, plan.generate, knowledge.manage, and brd/frd/plan.approve.
- Approving a BRD, FRD or implementation plan needs the matching approve permission and someone other than the author (admins excepted). A new built-in Reviewer role holds the approvals; Functional no longer does.
- Functional no longer has settings.manage.
- Developers can read implementation plans (plan.view) without changing them.
- Excitor Core Role Profiles are mapped per role in Accounts & Access -> Roles, stored in the database and logged; .env stays as a fallback.
- ACCOUNTS_REQUIRED defaults to true; the admin key keeps its identity.
- Custom roles made before this get the BRD/FRD/plan permissions their tier gave them, once, without approval.
- Sidebar, dashboard and screens follow permissions; approve buttons show why approval is unavailable.