Permission Catalogue & Delegation

A governed catalogue of explicit action identifiers. Every enforceable action is listed with its enforcement point and sensitivity. Unknown permissions are denied by default. Admins may only grant or delegate permissions within their own ceiling — never self-elevate or exceed delegated scope.