rbac

type Assignment struct {
	Persona           iam.Persona
	PermissionGroupID string
	Role              iam.Role
}

type Persona struct {
	Name iam.Persona
	// Permissions is the complete catalog: app-declared plus built-ins, sorted.
	Permissions []iam.Perm
	Roles       []Role // declared roles (includes flattened) plus owner
	APIKeys     bool
}

type PersonaSpec struct {
	Name               iam.Persona
	Permissions        []iam.Perm // app-defined catalog; AuthKit adds its built-ins
	RequireMFA         []iam.Perm // permissions or patterns of the catalog that need MFA
	APIKeys            bool
	RemoteApplications bool
}

type Role struct {
	Name        iam.Role
	Permissions []string
	RequiresMFA bool
}

type RoleSpec struct {
	Name     iam.Role
	Grants   []iam.Perm // permissions or patterns
	Includes []iam.Role // roles of the same persona
}

type Schema struct {
	// contains filtered or unexported fields
}