- 4 roles: SuperAdmin, Operator, Reviewer, PilotUser
- Capabilities (not pages): mission.create, artifact.view, decision.approve, etc.
- Feature flags: ENABLE_REPLAY, ENABLE_MODEL_TRAINING, etc.
- Developer Mode toggle in UI (activated by permission)
- New rule: All features must link to module, capability, and role
Next: Deploy pilot environment
Bernt