iam

var (

	// ApiInitiator represents API gateway service for external requests.
	ApiInitiator cqrsiam.Initiator = "api"
	// AgentBacktest represents the standalone backtest agent service that processes task files.
	AgentBacktest cqrsiam.Initiator = "agent-backtest"
	// CoreBacktestAgentJob represents the job execution service for backtest processing.
	CoreBacktestAgentJob cqrsiam.Initiator = "core-backtest-agent-job"
	// CoreBacktestAgentOptimize represents the optimization service for parameter tuning.
	CoreBacktestAgentOptimize cqrsiam.Initiator = "core-backtest-agent-optimize"
	// CoreBacktestAgentQueue represents the queue service that triggers backtests automatically.
	CoreBacktestAgentQueue cqrsiam.Initiator = "core-backtest-agent-queue"
	// CoreBacktestAgentRun represents the execution service that runs individual backtests.
	CoreBacktestAgentRun cqrsiam.Initiator = "core-backtest-agent-run"
	// CoreBacktestController represents the main backtest controller service.
	CoreBacktestController cqrsiam.Initiator = "core-backtest-controller"
	// CoreBacktestDummyUser represents a test user for backtest operations.
	CoreBacktestDummyUser cqrsiam.Initiator = "core-backtest-dummyuser"
	// CoreBacktestCron represents the automated strategy queuing service.
	CoreBacktestCron cqrsiam.Initiator = "core-backtest-cron"
	// CoreReview represents the review management service.
	CoreReview cqrsiam.Initiator = "core-review"
	// CoreStrategy represents the strategy management service.
	CoreStrategy cqrsiam.Initiator = "core-strategy"
	// CoreStrategyPublishStrategies represents the strategy publishing command service.
	CoreStrategyPublishStrategies cqrsiam.Initiator = "core-strategy-publish-strategies"
	// CoreStrategyWatchStrategies represents the strategy watching command service.
	CoreStrategyWatchStrategies cqrsiam.Initiator = "core-strategy-watch-strategies"
	// CoreReportCronjob represents the automated report scheduling service.
	CoreReportCronjob cqrsiam.Initiator = "core-report-cron"
	// CoreMailControllerRefreshTokenCronjob represents the daily OAuth2 token refresh CronJob.
	CoreMailControllerRefreshTokenCronjob cqrsiam.Initiator = "core-mail-controller-refresh-token-cronjob" // #nosec G101 -- false positive: this is a service identifier, not a credential
	// Mt5TradeExecutor represents the MT5 broker integration service that handles order/position callbacks.
	Mt5TradeExecutor cqrsiam.Initiator = "mt5-trade-executor"
	// CapitalcomTradeExecutor represents the Capital.com broker integration service that handles order/position callbacks.
	CapitalcomTradeExecutor cqrsiam.Initiator = "capitalcom-trade-executor"

	// CoreNotificationController sends discord messages for alerts and notifications.
	CoreNotificationController cqrsiam.Initiator = "core-notification-controller"
	// CoreActualTradeController represents the actual trade controller service that manages trade execution.
	CoreActualTradeController cqrsiam.Initiator = "core-actualtrade-controller"
	// Mt5AccountConverter represents the MT5 account converter service that processes raw MT5 account data.
	Mt5AccountConverter cqrsiam.Initiator = "mt5-account-converter"
	// Mt5AccountController represents the MT5 account controller service that manages MT5 account lifecycle.
	Mt5AccountController cqrsiam.Initiator = "mt5-account-controller"

	// UserBenBusiness represents the business account for trading operations.
	UserBenBusiness cqrsiam.Initiator = "borbe.capital@gmail.com"
	// UserBenPrivate represents the personal administrative account.
	UserBenPrivate cqrsiam.Initiator = "benjamin.borbe@gmail.com"
	// UserBenSeibert represents the corporate development account.
	UserBenSeibert cqrsiam.Initiator = "benjamin.borbe@seibert.group"
	// UserStefan represents an additional authorized user.
	UserStefan cqrsiam.Initiator = "stefan.nicolin@googlemail.com"

	// BossOpenClaw represents the Boss AI assistant with readonly monitoring access.
	BossOpenClaw cqrsiam.Initiator = "boss-openclaw"
	// TradingOpenClaw represents the Trading AI assistant with readonly access (may expand later).
	TradingOpenClaw cqrsiam.Initiator = "trading-openclaw"

	// CapitalcomMarketDetailConverter converts market details from CapitalCom into trading symbols.
	CapitalcomMarketDetailConverter cqrsiam.Initiator = "capitalcom-marketdetail-converter"
	// AcgSymbolConverter converts symbols from ACG broker into trading symbols.
	AcgSymbolConverter cqrsiam.Initiator = "acg-symbol-converter"
	// DwxSymbolConverter converts symbols from DWX broker into trading symbols.
	DwxSymbolConverter cqrsiam.Initiator = "dwx-symbol-converter"
	// FtmoSymbolConverter converts symbols from FTMO broker into trading symbols.
	FtmoSymbolConverter cqrsiam.Initiator = "ftmo-symbol-converter"
	// CapitalcomAccountConverter converts account data from CapitalCom broker into trading accounts.
	CapitalcomAccountConverter cqrsiam.Initiator = "capitalcom-account-converter"

	// ForexfactoryDetailConverter converts forex factory details into news entries.
	ForexfactoryDetailConverter cqrsiam.Initiator = "forexfactory-detail-converter"
	// FtmoEconomicCalendarConverter converts FTMO economic calendar events into news.
	FtmoEconomicCalendarConverter cqrsiam.Initiator = "ftmo-economiccalendar-converter"
	// TagesschauConverter converts Tagesschau news articles into trading news.
	TagesschauConverter cqrsiam.Initiator = "tagesschau-converter"
	// FinancialjuiceEventConverter converts FinancialJuice events into trading news.
	FinancialjuiceEventConverter cqrsiam.Initiator = "financialjuice-event-converter"
)

var (
	// Backtest cqrsiam.Permissions
	CoreBacktestActiveStrategiesPermission cqrsiam.Permission = "backtest.active-strategies"
	CoreBacktestAdminPermission            cqrsiam.Permission = "backtest.admin"
	CoreBacktestCreatePermission           cqrsiam.Permission = "backtest.create"
	CoreBacktestDeleteGroupPermission      cqrsiam.Permission = "backtest.delete-group"
	CoreBacktestDeletePermission           cqrsiam.Permission = "backtest.delete"
	CoreBacktestQueuePermission            cqrsiam.Permission = "backtest.queue"
	CoreBacktestRecreateJobPermission      cqrsiam.Permission = "backtest.recreate-job"
	CoreBacktestRerunFailedPermission      cqrsiam.Permission = "backtest.rerun-failed"
	CoreBacktestFailRunningPermission      cqrsiam.Permission = "backtest.fail-running"
	CoreBacktestUpdatePermission           cqrsiam.Permission = "backtest.update"

	// Review cqrsiam.Permissions
	CoreReviewAdminPermission  cqrsiam.Permission = "review.admin"
	CoreReviewCreatePermission cqrsiam.Permission = "review.create"
	CoreReviewDeletePermission cqrsiam.Permission = "review.delete"
	CoreReviewReviewPermission cqrsiam.Permission = "review.review"

	// Strategy cqrsiam.Permissions
	CoreStrategyCreatePermission  cqrsiam.Permission = "strategy.create"
	CoreStrategyUpdatePermission  cqrsiam.Permission = "strategy.update"
	CoreStrategyDeletePermission  cqrsiam.Permission = "strategy.delete"
	CoreStrategyDisablePermission cqrsiam.Permission = "strategy.disable"
	CoreStrategyAdminPermission   cqrsiam.Permission = "strategy.admin"

	// Report cqrsiam.Permissions
	CoreReportSendPermission  cqrsiam.Permission = "report.send"
	CoreReportAdminPermission cqrsiam.Permission = "report.admin"

	// Mail cqrsiam.Permissions
	CoreMailSendPermission         cqrsiam.Permission = "mail.send"
	CoreMailRefreshTokenPermission cqrsiam.Permission = "mail.refresh-token"
	CoreMailAdminPermission        cqrsiam.Permission = "mail.admin"

	// Symbol cqrsiam.Permissions
	CoreSymbolFetchPermission  cqrsiam.Permission = "symbol.fetch"
	CoreSymbolAdminPermission  cqrsiam.Permission = "symbol.admin"
	CoreSymbolCreatePermission cqrsiam.Permission = "symbol.create"
	CoreSymbolUpdatePermission cqrsiam.Permission = "symbol.update"
	CoreSymbolDeletePermission cqrsiam.Permission = "symbol.delete"

	// MT5Account cqrsiam.Permissions
	Mt5AccountCreatePermission       cqrsiam.Permission = "mt5account.create"
	Mt5AccountUpdatePermission       cqrsiam.Permission = "mt5account.update"
	Mt5AccountDeletePermission       cqrsiam.Permission = "mt5account.delete"
	Mt5AccountAdminPermission        cqrsiam.Permission = "mt5account.admin"
	Mt5AccountSyncAccountsPermission cqrsiam.Permission = "mt5account.sync-accounts"

	// MT5Tick cqrsiam.Permissions
	Mt5TickSelectSymbolsPermission cqrsiam.Permission = "mt5tick.select-symbols"

	// ExpectedTrade cqrsiam.Permissions
	CoreExpectedTradeApprovePermission cqrsiam.Permission = "expectedtrade.approve"
	CoreExpectedTradeRejectPermission  cqrsiam.Permission = "expectedtrade.reject"
	CoreExpectedTradeClosePermission   cqrsiam.Permission = "expectedtrade.close"
	CoreExpectedTradeHedgePermission   cqrsiam.Permission = "expectedtrade.hedge"
	CoreExpectedTradeAdminPermission   cqrsiam.Permission = "expectedtrade.admin"

	// Account cqrsiam.Permissions
	CoreAccountAdminPermission  cqrsiam.Permission = "account.admin"
	CoreAccountCreatePermission cqrsiam.Permission = "account.create"
	CoreAccountUpdatePermission cqrsiam.Permission = "account.update"
	CoreAccountDeletePermission cqrsiam.Permission = "account.delete"

	// Closing cqrsiam.Permissions
	CoreClosingAdminPermission  cqrsiam.Permission = "closing.admin"
	CoreClosingCreatePermission cqrsiam.Permission = "closing.create"
	CoreClosingUpdatePermission cqrsiam.Permission = "closing.update"
	CoreClosingDeletePermission cqrsiam.Permission = "closing.delete"

	// Discord cqrsiam.Permissions
	CoreDiscordSendPermission  cqrsiam.Permission = "discord.send"
	CoreDiscordAdminPermission cqrsiam.Permission = "discord.admin"

	// Telegram cqrsiam.Permissions
	CoreTelegramSendPermission  cqrsiam.Permission = "telegram.send"
	CoreTelegramAdminPermission cqrsiam.Permission = "telegram.admin"

	// News cqrsiam.Permissions
	CoreNewsUpdatePermission cqrsiam.Permission = "news.update"
	CoreNewsRatePermission   cqrsiam.Permission = "news.rate"
	CoreNewsAdminPermission  cqrsiam.Permission = "news.admin"

	// Signal cqrsiam.Permissions
	CoreSignalCreatePermission    cqrsiam.Permission = "signal.create"
	CoreSignalModifyPermission    cqrsiam.Permission = "signal.modify"
	CoreSignalClosePermission     cqrsiam.Permission = "signal.close"
	CoreSignalBreakEvenPermission cqrsiam.Permission = "signal.breakeven"
	CoreSignalAdminPermission     cqrsiam.Permission = "signal.admin"

	// ActualTrade cqrsiam.Permissions
	CoreActualTradeRetryPermission          cqrsiam.Permission = "actualtrade.retry"
	CoreActualTradeBrokerCallbackPermission cqrsiam.Permission = "actualtrade.broker-callback"
	CoreActualTradeAdminPermission          cqrsiam.Permission = "actualtrade.admin"

	// Frontend cqrsiam.Permissions
	FrontendGatewayAdminPermission cqrsiam.Permission = "frontend.gateway.admin"
)

var (
	// BacktestAdmin provides full administrative access to backtest operations.
	// Intended for: Core administrators and the backtest controller service.
	// cqrsiam.Permissions: All backtest operations including admin-level functions.
	BacktestAdmin = cqrsiam.NewRole("BacktestAdmin",
		CoreBacktestActiveStrategiesPermission,
		CoreBacktestAdminPermission,
		CoreBacktestCreatePermission,
		CoreBacktestDeletePermission,
		CoreBacktestDeleteGroupPermission,
		CoreBacktestQueuePermission,
		CoreBacktestRecreateJobPermission,
		CoreBacktestRerunFailedPermission,
		CoreBacktestFailRunningPermission,
		CoreBacktestUpdatePermission,
	)
	// BacktestCron provides minimal permissions for scheduled backtest operations.
	// Intended for: Cron jobs and automated strategy queuing services.
	// cqrsiam.Permissions: Only access to active strategies for automated queuing.
	BacktestCron = cqrsiam.NewRole("BacktestUser",
		CoreBacktestActiveStrategiesPermission,
	)
	// BacktestUser provides standard backtest operations for regular users and services.
	// Intended for: API users, business users, and backtest agent services.
	// cqrsiam.Permissions: Create, delete, update, and queue backtests (excludes admin functions).
	BacktestUser = cqrsiam.NewRole("BacktestUser",
		CoreBacktestCreatePermission,
		CoreBacktestDeletePermission,
		CoreBacktestDeleteGroupPermission,
		CoreBacktestQueuePermission,
		CoreBacktestUpdatePermission,
	)
	// BacktestViewer provides read-only access to backtest data.
	// Intended for: Users who need to view but not modify backtest results.
	// cqrsiam.Permissions: None (read-only access through other mechanisms).
	BacktestViewer = cqrsiam.NewRole("BacktestViewer")
	// BacktestCreator provides minimal permissions for services that only create backtests.
	// Intended for: Automated services like core-backtest-agent-queue that trigger backtests.
	// cqrsiam.Permissions: Only backtest creation (follows principle of least privilege).
	BacktestCreator = cqrsiam.NewRole("BacktestCreator",
		CoreBacktestCreatePermission,
	)
	// ReviewAdmin provides full administrative access to review operations.
	// Intended for: Core administrators and the review service.
	// cqrsiam.Permissions: All review operations including admin functions.
	ReviewAdmin = cqrsiam.NewRole("ReviewAdmin",
		CoreReviewAdminPermission,
		CoreReviewCreatePermission,
		CoreReviewDeletePermission,
		CoreReviewReviewPermission,
	)
	// ReviewUser provides standard review operations for regular users.
	// Intended for: Business users who can participate in review processes.
	// cqrsiam.Permissions: Review and comment on items (excludes admin functions).
	ReviewUser = cqrsiam.NewRole("ReviewUser",
		CoreReviewReviewPermission,
	)
	// ReviewViewer provides read-only access to review data.
	// Intended for: Users who need to view but not participate in reviews.
	// cqrsiam.Permissions: None (read-only access through other mechanisms).
	ReviewViewer = cqrsiam.NewRole("ReviewViewer")

	// StrategyAdmin provides full administrative access to strategy operations.
	// Intended for: Core administrators and the strategy service.
	// cqrsiam.Permissions: All strategy operations including admin-level functions.
	StrategyAdmin = cqrsiam.NewRole("StrategyAdmin",
		CoreStrategyCreatePermission,
		CoreStrategyUpdatePermission,
		CoreStrategyDeletePermission,
		CoreStrategyDisablePermission,
		CoreStrategyAdminPermission,
	)
	// StrategyUser provides standard strategy operations for regular users and services.
	// Intended for: API users and business users managing strategies.
	// cqrsiam.Permissions: Create, update, and disable strategies (excludes delete and admin functions).
	StrategyUser = cqrsiam.NewRole("StrategyUser",
		CoreStrategyCreatePermission,
		CoreStrategyUpdatePermission,
		CoreStrategyDisablePermission,
	)
	// StrategyViewer provides read-only access to strategy data.
	// Intended for: Users who need to view but not modify strategies.
	// cqrsiam.Permissions: None (read-only access through other mechanisms).
	StrategyViewer = cqrsiam.NewRole("StrategyViewer")

	// SymbolAdmin provides full administrative access to symbol operations.
	// Intended for: Core administrators and symbol services.
	// cqrsiam.Permissions: All symbol operations including admin-level functions.
	SymbolAdmin = cqrsiam.NewRole("SymbolAdmin",
		CoreSymbolFetchPermission,
		CoreSymbolAdminPermission,
		CoreSymbolCreatePermission,
		CoreSymbolUpdatePermission,
		CoreSymbolDeletePermission,
	)
	// SymbolUser provides standard symbol operations for regular users and services.
	// Intended for: API users and business users fetching market information.
	// cqrsiam.Permissions: Fetch market details (excludes admin functions).
	SymbolUser = cqrsiam.NewRole("SymbolUser",
		CoreSymbolFetchPermission,
		CoreSymbolCreatePermission,
		CoreSymbolUpdatePermission,
	)

	// ReportAdmin provides full administrative access to report operations.
	// Intended for: Core administrators who can trigger and manage reports.
	// cqrsiam.Permissions: All report operations including sending reports.
	ReportAdmin = cqrsiam.NewRole("ReportAdmin",
		CoreReportSendPermission,
		CoreReportAdminPermission,
		CoreMailSendPermission,
	)
	// ReportCron provides minimal permissions for scheduled report operations.
	// Intended for: Cron jobs that send automated trading reports.
	// cqrsiam.Permissions: Report sending and mail sending capabilities.
	ReportCron = cqrsiam.NewRole("ReportCron",
		CoreReportSendPermission,
		CoreMailSendPermission,
	)

	// MailRefresh provides permissions for OAuth2 token refresh and mail sending operations.
	// Intended for: CronJob that refreshes OAuth2 tokens and API users who can send mails.
	// cqrsiam.Permissions: OAuth2 token refresh and mail sending capabilities.
	MailRefresh = cqrsiam.NewRole("MailRefresh",
		CoreMailRefreshTokenPermission,
		CoreMailSendPermission,
	)

	// Mt5AccountAdmin provides full administrative access to MT5 account operations.
	// Intended for: Core administrators and MT5 account controller service.
	// cqrsiam.Permissions: All MT5 account operations including admin functions.
	Mt5AccountAdmin = cqrsiam.NewRole("Mt5AccountAdmin",
		Mt5AccountAdminPermission,
		Mt5AccountCreatePermission,
		Mt5AccountUpdatePermission,
		Mt5AccountDeletePermission,
	)
	// Mt5AccountUser provides standard MT5 account operations for converters and services.
	// Intended for: MT5 converters and automated services that process account data.
	// cqrsiam.Permissions: Create and update MT5 accounts (not delete - admin only).
	Mt5AccountUser = cqrsiam.NewRole("Mt5AccountUser",
		Mt5AccountCreatePermission,
		Mt5AccountUpdatePermission,
	)
	// Mt5AccountViewer provides read-only access to MT5 account data.
	// Intended for: Users who need to view but not modify MT5 accounts (e.g., monitoring services).
	// cqrsiam.Permissions: None (read-only access through other mechanisms).
	Mt5AccountViewer = cqrsiam.NewRole("Mt5AccountViewer")

	// ExpectedTradeAdmin provides full administrative access to expected trade operations.
	// Intended for: Core administrators and the expected trade controller service.
	// cqrsiam.Permissions: All expected trade operations including admin functions.
	ExpectedTradeAdmin = cqrsiam.NewRole("ExpectedTradeAdmin",
		CoreExpectedTradeAdminPermission,
		CoreExpectedTradeApprovePermission,
		CoreExpectedTradeRejectPermission,
		CoreExpectedTradeClosePermission,
		CoreExpectedTradeHedgePermission,
	)
	// ExpectedTradeUser provides standard expected trade operations for traders.
	// Intended for: Traders who can approve and reject expected trades.
	// cqrsiam.Permissions: Approve and reject expected trades.
	ExpectedTradeUser = cqrsiam.NewRole("ExpectedTradeUser",
		CoreExpectedTradeApprovePermission,
		CoreExpectedTradeRejectPermission,
		CoreExpectedTradeClosePermission,
		CoreExpectedTradeHedgePermission,
	)
	// ExpectedTradeViewer provides read-only access to expected trade data.
	// Intended for: Users who need to view but not modify expected trades (e.g., monitoring services).
	// cqrsiam.Permissions: None (read-only access through other mechanisms).
	ExpectedTradeViewer = cqrsiam.NewRole("ExpectedTradeViewer")

	// AccountAdmin provides full administrative access to account operations.
	// Intended for: Core administrators and the account controller service.
	// cqrsiam.Permissions: All account operations including admin-level functions.
	AccountAdmin = cqrsiam.NewRole("AccountAdmin",
		CoreAccountAdminPermission,
		CoreAccountCreatePermission,
		CoreAccountUpdatePermission,
		CoreAccountDeletePermission,
	)
	// AccountUser provides standard account operations for regular users and services.
	// Intended for: API users and business users managing accounts.
	// cqrsiam.Permissions: Create and update accounts (excludes delete and admin functions).
	AccountUser = cqrsiam.NewRole("AccountUser",
		CoreAccountCreatePermission,
		CoreAccountUpdatePermission,
	)

	// ClosingAdmin provides full administrative access to closing operations.
	// Intended for: Core administrators and the closing controller service.
	// cqrsiam.Permissions: All closing operations including admin-level functions.
	ClosingAdmin = cqrsiam.NewRole("ClosingAdmin",
		CoreClosingAdminPermission,
		CoreClosingCreatePermission,
		CoreClosingUpdatePermission,
		CoreClosingDeletePermission,
	)
	// ClosingUser provides standard closing operations for regular users and services.
	// Intended for: API users and business users managing closings.
	// cqrsiam.Permissions: Create and update closings (excludes delete and admin functions).
	ClosingUser = cqrsiam.NewRole("ClosingUser",
		CoreClosingCreatePermission,
		CoreClosingUpdatePermission,
	)

	// DiscordAdmin provides full administrative access to discord operations.
	// Intended for: Core administrators and the discord controller service.
	// cqrsiam.Permissions: All discord operations including admin-level functions.
	DiscordAdmin = cqrsiam.NewRole("DiscordAdmin",
		CoreDiscordAdminPermission,
		CoreDiscordSendPermission,
	)
	// DiscordUser provides standard discord operations for regular users and services.
	// Intended for: API users and services that send discord messages.
	// cqrsiam.Permissions: Send discord messages (excludes admin functions).
	DiscordUser = cqrsiam.NewRole("DiscordUser",
		CoreDiscordSendPermission,
	)

	// TelegramAdmin provides full administrative access to telegram operations.
	// Intended for: Core administrators and the telegram controller service.
	// cqrsiam.Permissions: All telegram operations including admin-level functions.
	TelegramAdmin = cqrsiam.NewRole("TelegramAdmin",
		CoreTelegramAdminPermission,
		CoreTelegramSendPermission,
	)
	// TelegramUser provides standard telegram operations for regular users and services.
	// Intended for: API users and services that send telegram messages.
	// cqrsiam.Permissions: Send telegram messages (excludes admin functions).
	TelegramUser = cqrsiam.NewRole("TelegramUser",
		CoreTelegramSendPermission,
	)

	// NewsAdmin provides full administrative access to news operations.
	// Intended for: Core administrators and the news controller service.
	// cqrsiam.Permissions: All news operations including admin functions.
	NewsAdmin = cqrsiam.NewRole("NewsAdmin",
		CoreNewsAdminPermission,
		CoreNewsUpdatePermission,
		CoreNewsRatePermission,
	)
	// NewsUser provides standard news operations for regular users and services.
	// Intended for: Services and users that create and modify news entries.
	// cqrsiam.Permissions: Update and rate news entries.
	NewsUser = cqrsiam.NewRole("NewsUser",
		CoreNewsUpdatePermission,
		CoreNewsRatePermission,
	)
	// NewsViewer provides read-only access to news data.
	// Intended for: Users who need to view but not modify news (e.g., monitoring services).
	// cqrsiam.Permissions: None (read-only access through other mechanisms).
	NewsViewer = cqrsiam.NewRole("NewsViewer")

	// SignalAdmin provides full administrative access to signal operations.
	// Intended for: Core administrators and signal services.
	// cqrsiam.Permissions: All signal operations including break-even and admin functions.
	SignalAdmin = cqrsiam.NewRole("SignalAdmin",
		CoreSignalCreatePermission,
		CoreSignalModifyPermission,
		CoreSignalClosePermission,
		CoreSignalBreakEvenPermission,
		CoreSignalAdminPermission,
	)
	// SignalUser provides standard signal operations for traders.
	// Intended for: Traders who can create, modify, and close trading signals.
	// cqrsiam.Permissions: Create, modify, and close signals (excludes break-even and admin).
	SignalUser = cqrsiam.NewRole("SignalUser",
		CoreSignalCreatePermission,
		CoreSignalModifyPermission,
		CoreSignalClosePermission,
	)
	// SignalViewer provides read-only access to signal data.
	// Intended for: Users who need to view but not modify signals (e.g., monitoring services).
	// cqrsiam.Permissions: None (read-only access through other mechanisms).
	SignalViewer = cqrsiam.NewRole("SignalViewer")

	// ActualTradeAdmin provides full administrative access to actual trade operations.
	// Intended for: Core administrators and the actual trade controller service.
	// cqrsiam.Permissions: All actual trade operations including admin functions.
	ActualTradeAdmin = cqrsiam.NewRole("ActualTradeAdmin",
		CoreActualTradeRetryPermission,
		CoreActualTradeBrokerCallbackPermission,
		CoreActualTradeAdminPermission,
	)
	// ActualTradeUser provides standard actual trade operations for traders.
	// Intended for: Traders who can retry failed trades.
	// cqrsiam.Permissions: Retry failed trades.
	ActualTradeUser = cqrsiam.NewRole("ActualTradeUser",
		CoreActualTradeRetryPermission,
	)
	// ActualTradeBrokerCallback provides broker callback permissions.
	// Intended for: Broker converter services that send order/position updates.
	// cqrsiam.Permissions: All broker callback operations.
	ActualTradeBrokerCallback = cqrsiam.NewRole("ActualTradeBrokerCallback",
		CoreActualTradeBrokerCallbackPermission,
	)
	// ActualTradeViewer provides read-only access to actual trade data.
	// Intended for: Users who need to view but not modify actual trades (e.g., monitoring services).
	// cqrsiam.Permissions: None (read-only access through other mechanisms).
	ActualTradeViewer = cqrsiam.NewRole("ActualTradeViewer")

	// Mt5SyncTrigger provides permission to trigger the two MT5 sync operations.
	// Intended for: the API gateway identity (ApiInitiator, shared with every other
	// business-tier automation via FRONTEND_GATEWAY_API_KEY in every environment, not
	// dev-scoped) and the human administrator. This deviates from the Mt5AccountAdmin
	// precedent of keeping admin-tier permissions off ApiInitiator (iam_rolebinding.go);
	// it is accepted here because both operations are idempotent refreshes (re-select
	// symbols, re-read account state) — nothing is created, deleted, or traded, and no
	// money moves. That is a materially smaller blast radius than Mt5AccountAdmin
	// (create/update/delete accounts), which is why the deviation is acceptable rather
	// than merely convenient. scripts/api-call.sh, which authenticates as this identity,
	// must be able to trigger these without a human-authenticated session.
	// cqrsiam.Permissions: MT5 symbol re-selection and MT5 account re-read triggers.
	Mt5SyncTrigger = cqrsiam.NewRole("Mt5SyncTrigger",
		Mt5TickSelectSymbolsPermission,
		Mt5AccountSyncAccountsPermission,
	)

	// SuperAdmin provides full system administrative access including gateway admin routes.
	// Intended for: System administrators who need access to all admin interfaces.
	// cqrsiam.Permissions: Gateway admin access for service management.
	SuperAdmin = cqrsiam.NewRole("SuperAdmin",
		FrontendGatewayAdminPermission,
	)
)

var AvailableInitiators = cqrsiam.Initiators{
	AgentBacktest,
	ApiInitiator,
	UserBenSeibert,
	CoreBacktestAgentJob,
	CoreBacktestAgentOptimize,
	CoreBacktestAgentQueue,
	CoreBacktestAgentRun,
	CoreBacktestController,
	CoreBacktestDummyUser,
	CoreBacktestCron,
	CoreReview,
	CoreStrategy,
	CoreStrategyPublishStrategies,
	CoreStrategyWatchStrategies,
	CoreReportCronjob,
	CoreMailControllerRefreshTokenCronjob,
	Mt5TradeExecutor,
	CapitalcomTradeExecutor,
	CoreNotificationController,
	CoreActualTradeController,
	Mt5AccountConverter,
	Mt5AccountController,
	UserStefan,
	UserBenBusiness,
	UserBenPrivate,
	BossOpenClaw,
	TradingOpenClaw,
	CapitalcomMarketDetailConverter,
	AcgSymbolConverter,
	DwxSymbolConverter,
	FtmoSymbolConverter,
	Mt5AccountConverter,
	CapitalcomAccountConverter,
	ForexfactoryDetailConverter,
	FtmoEconomicCalendarConverter,
	TagesschauConverter,
	FinancialjuiceEventConverter,
}

var AvailablePermissions = cqrsiam.Permissions{
	CoreBacktestActiveStrategiesPermission,
	CoreBacktestAdminPermission,
	CoreBacktestCreatePermission,
	CoreBacktestDeleteGroupPermission,
	CoreBacktestDeletePermission,
	CoreBacktestQueuePermission,
	CoreBacktestRecreateJobPermission,
	CoreBacktestRerunFailedPermission,
	CoreBacktestFailRunningPermission,
	CoreBacktestUpdatePermission,
	CoreReviewAdminPermission,
	CoreReviewCreatePermission,
	CoreReviewDeletePermission,
	CoreReviewReviewPermission,
	CoreStrategyCreatePermission,
	CoreStrategyUpdatePermission,
	CoreStrategyDeletePermission,
	CoreStrategyDisablePermission,
	CoreStrategyAdminPermission,
	CoreReportSendPermission,
	CoreReportAdminPermission,
	CoreMailSendPermission,
	CoreMailRefreshTokenPermission,
	CoreMailAdminPermission,
	CoreSymbolFetchPermission,
	CoreSymbolAdminPermission,
	CoreSymbolCreatePermission,
	CoreSymbolUpdatePermission,
	CoreSymbolDeletePermission,
	Mt5AccountCreatePermission,
	Mt5AccountUpdatePermission,
	Mt5AccountDeletePermission,
	Mt5AccountAdminPermission,
	Mt5AccountSyncAccountsPermission,
	Mt5TickSelectSymbolsPermission,
	CoreExpectedTradeApprovePermission,
	CoreExpectedTradeRejectPermission,
	CoreExpectedTradeClosePermission,
	CoreExpectedTradeHedgePermission,
	CoreExpectedTradeAdminPermission,
	CoreAccountAdminPermission,
	CoreAccountCreatePermission,
	CoreAccountUpdatePermission,
	CoreAccountDeletePermission,
	CoreClosingAdminPermission,
	CoreClosingCreatePermission,
	CoreClosingUpdatePermission,
	CoreClosingDeletePermission,
	CoreDiscordSendPermission,
	CoreDiscordAdminPermission,
	CoreTelegramSendPermission,
	CoreTelegramAdminPermission,
	CoreNewsUpdatePermission,
	CoreNewsRatePermission,
	CoreNewsAdminPermission,
	CoreSignalCreatePermission,
	CoreSignalModifyPermission,
	CoreSignalClosePermission,
	CoreSignalBreakEvenPermission,
	CoreSignalAdminPermission,
	CoreActualTradeRetryPermission,
	CoreActualTradeBrokerCallbackPermission,
	CoreActualTradeAdminPermission,
	FrontendGatewayAdminPermission,
}

var AvailableRoleBindings = cqrsiam.RoleBindings{
	cqrsiam.NewRoleBinding(BacktestAdmin, UserBenPrivate, CoreBacktestController),
	cqrsiam.NewRoleBinding(BacktestCron, CoreBacktestCron),
	cqrsiam.NewRoleBinding(
		BacktestUser,
		ApiInitiator,
		UserBenBusiness,
		CoreBacktestAgentJob,
		CoreBacktestAgentOptimize,
		CoreBacktestAgentRun,
		AgentBacktest,
	),
	cqrsiam.NewRoleBinding(BacktestCreator, CoreBacktestAgentQueue),
	cqrsiam.NewRoleBinding(BacktestViewer, BossOpenClaw, TradingOpenClaw),
	cqrsiam.NewRoleBinding(ActualTradeAdmin, UserBenPrivate, CoreActualTradeController),
	cqrsiam.NewRoleBinding(ActualTradeBrokerCallback, Mt5TradeExecutor, CapitalcomTradeExecutor),
	cqrsiam.NewRoleBinding(ReviewAdmin, UserBenPrivate, CoreReview),
	cqrsiam.NewRoleBinding(ReviewUser, UserBenBusiness),
	cqrsiam.NewRoleBinding(ReviewViewer, BossOpenClaw, TradingOpenClaw),
	cqrsiam.NewRoleBinding(
		StrategyAdmin,
		UserBenPrivate,
		CoreStrategy,
		CoreStrategyPublishStrategies,
		CoreStrategyWatchStrategies,
	),
	cqrsiam.NewRoleBinding(StrategyUser, ApiInitiator, UserBenBusiness),
	cqrsiam.NewRoleBinding(StrategyViewer, BossOpenClaw, TradingOpenClaw),
	cqrsiam.NewRoleBinding(SymbolAdmin, UserBenPrivate),
	cqrsiam.NewRoleBinding(
		SymbolUser,
		ApiInitiator,
		CapitalcomMarketDetailConverter,
		AcgSymbolConverter,
		DwxSymbolConverter,
		FtmoSymbolConverter,
	),
	cqrsiam.NewRoleBinding(ClosingAdmin, UserBenPrivate),
	cqrsiam.NewRoleBinding(ClosingUser, ApiInitiator),
	cqrsiam.NewRoleBinding(Mt5AccountAdmin, UserBenPrivate, Mt5AccountController),
	cqrsiam.NewRoleBinding(Mt5AccountUser, Mt5AccountConverter, ApiInitiator),
	cqrsiam.NewRoleBinding(Mt5AccountViewer, BossOpenClaw, TradingOpenClaw),
	cqrsiam.NewRoleBinding(ExpectedTradeAdmin, UserBenPrivate),
	cqrsiam.NewRoleBinding(ExpectedTradeUser, UserBenBusiness, ApiInitiator),
	cqrsiam.NewRoleBinding(ExpectedTradeViewer, BossOpenClaw, TradingOpenClaw),
	cqrsiam.NewRoleBinding(SignalAdmin, UserBenPrivate),
	cqrsiam.NewRoleBinding(SignalUser, UserBenBusiness, ApiInitiator),
	cqrsiam.NewRoleBinding(SignalViewer, BossOpenClaw, TradingOpenClaw),
	cqrsiam.NewRoleBinding(ActualTradeUser, UserBenBusiness, ApiInitiator),
	cqrsiam.NewRoleBinding(ActualTradeViewer, BossOpenClaw, TradingOpenClaw),
	cqrsiam.NewRoleBinding(ReportAdmin, UserBenPrivate),
	cqrsiam.NewRoleBinding(ReportCron, CoreReportCronjob),
	cqrsiam.NewRoleBinding(MailRefresh, CoreMailControllerRefreshTokenCronjob, ApiInitiator),
	cqrsiam.NewRoleBinding(AccountAdmin, UserBenPrivate),
	cqrsiam.NewRoleBinding(
		AccountUser,
		ApiInitiator,
		Mt5AccountConverter,
		CapitalcomAccountConverter,
	),
	cqrsiam.NewRoleBinding(DiscordAdmin, UserBenPrivate),
	cqrsiam.NewRoleBinding(DiscordUser, ApiInitiator, CoreNotificationController),
	cqrsiam.NewRoleBinding(TelegramAdmin, UserBenPrivate),
	cqrsiam.NewRoleBinding(TelegramUser, ApiInitiator, CoreNotificationController),
	cqrsiam.NewRoleBinding(NewsAdmin, UserBenPrivate),
	cqrsiam.NewRoleBinding(
		NewsUser,
		UserBenBusiness,
		ApiInitiator,
		FinancialjuiceEventConverter,
		ForexfactoryDetailConverter,
		FtmoEconomicCalendarConverter,
		TagesschauConverter,
	),
	cqrsiam.NewRoleBinding(NewsViewer, BossOpenClaw, TradingOpenClaw),
	cqrsiam.NewRoleBinding(Mt5SyncTrigger, ApiInitiator, UserBenPrivate),
	cqrsiam.NewRoleBinding(SuperAdmin, UserBenPrivate),
}

var AvailableRoles = cqrsiam.Roles{
	BacktestAdmin,
	BacktestUser,
	BacktestViewer,
	BacktestCreator,
	BacktestCron,
	ReviewAdmin,
	ReviewUser,
	ReviewViewer,
	StrategyAdmin,
	StrategyUser,
	StrategyViewer,
	SymbolAdmin,
	SymbolUser,
	ReportAdmin,
	ReportCron,
	MailRefresh,
	Mt5AccountAdmin,
	Mt5AccountUser,
	Mt5AccountViewer,
	ExpectedTradeAdmin,
	ExpectedTradeUser,
	ExpectedTradeViewer,
	AccountAdmin,
	AccountUser,
	ClosingAdmin,
	ClosingUser,
	DiscordAdmin,
	DiscordUser,
	TelegramAdmin,
	TelegramUser,
	NewsAdmin,
	NewsUser,
	NewsViewer,
	SignalAdmin,
	SignalUser,
	SignalViewer,
	ActualTradeAdmin,
	ActualTradeUser,
	ActualTradeBrokerCallback,
	ActualTradeViewer,
	Mt5SyncTrigger,
	SuperAdmin,
}