Tenant-scoped capability overrides. Each template adds / removes capabilities on top of the role-derived defaults; the resolver applies them at every request. Edits are gated on workspace.settings.update. Open the permissions matrix →
| Name | Scope | Applies to | Grants | Revokes | Memberships | Created | Active | |
|---|---|---|---|---|---|---|---|---|
| Estimator — exec view IDC convention: Estimators see the executive dashboard but cannot bulk-export reports. | workspace | Estimator | +1 | -1 | 0 | 30 May 26 | Edit → | |
| Finance access bundle Grants finance.read_full to anyone holding Financial Controller or Finance Officer. Adjust the role list to widen / narrow finance visibility. | workspace | Finance OfficerFinancial Controller | +1 | -0 | 1 | 30 May 26 | Edit → | |
| IDC Staff — baseline Tenant-wide baseline. Edit grant/revoke to layer overrides on top of role defaults. | workspace | All roles | +0 | -0 | 6 | 30 May 26 | Edit → |