# Permissions

Permissions live in `src/lib/permissions.ts`. Routes declare required permissions, and the shell/page renderer can show permission-denied states.

Initial roles include Super administrator and Read-only auditor. The roles screen exposes a detailed permission matrix covering every module and is ready to connect to a backend RBAC API.