# The default roles this brick recommends: a starting point, not a rule. The brick checks PERMISSIONS only, never a
# role's name; a composition maps its own pool roles to these permissions (or grants pj:*:* to a manager) in its
# role catalogue. Each role says which of the spec's actors (module.yaml) it fills.
roles:
project_manager: # fills: manager, and project_lead on every project
[pj:project:read, pj:project:read_all, pj:project:plan, pj:project:write, pj:project:manage,
pj:item:read, pj:item:write, pj:item:accept, pj:settings:write]
project_lead: # fills: project_lead, on the projects they lead
[pj:project:read, pj:project:plan, pj:project:write, pj:item:read, pj:item:write, pj:item:accept]
team_member: # fills: contributor
[pj:item:read, pj:item:work]
billing: # fills: finance
[pj:project:read, pj:project:read_all, pj:item:read]
viewer: # reads what it is shown; no actor
[pj:project:read, pj:item:read]
scheduler: # fills: system — a machine (client_credentials), never a person
[pj:project:read, pj:project:read_all, pj:project:plan, pj:project:reconcile, pj:item:read]
service_clients: [scheduler]
# pj:project:reconcile is a machine permission: grant it only to the scheduler's service client.
# pj:item:accept_own (record the acceptance of work one submitted oneself) is held by NO default role: the customer
# grants it per role, or a wildcard such as pj:*:* reaches it.