# The default roles this brick recommends: module.yaml's actors, permission for permission. A starting point, not a
# rule. The brick checks PERMISSIONS only, never a role's name; a composition maps its own pool roles to these
# permissions (or grants product:*:* to an owner) in its role catalogue.
#
# Seeing drafts: a draft or archived product, and a draft or retired price list, are visible to whoever holds a WRITE
# permission of this module (the catalogue and pricing roles) or runs an AI step. The standard cost is visible to
# product:product:write alone. Sales sees active products and published prices, and never cost.
roles:
catalogue_manager: # fills: catalogue_manager (operations, the owner)
[product:product:read, product:product:write, product:product:archive, product:category:write,
product:class:write, product:settings:write]
planner: # fills: planner (the buyer, the warehouse manager) — product data per site
[product:product:read, product:site:write]
pricing_manager: # fills: pricing_manager (the owner, a commercial manager)
[product:product:read, product:price_list:read, product:price_list:write, product:price_list:publish,
product:customer_price_list:write, product:settings:write]
owner: # fills: owner — the owner or a finance controller; sets the controls on pricing authors
[product:product:read, product:price_list:read, product:settings:controls]
sales_rep: # fills: sales_rep
[product:product:read, product:price_list:read]
system: # fills: system — a machine (client_credentials), never a person
[product:product:read, product:price_list:read, product:catalogue:import, product:product:suggest,
product:price_list:check, product:migration:read, product:unit:mark_used]
service_clients: [system]
# product:settings:controls is held by neither the catalogue nor the pricing manager: it changes the second-person rule and
# the unusual-price threshold, the controls on the people who author prices. product:product:suggest and
# product:price_list:check are machine permissions: grant them only to the system's
# service client. A wildcard such as product:*:* never reaches them.