ecr: ECR-013A
capability: AdminGovernance
bounded_context: Admin_RBAC
parent: WAVE0-FROZEN
change:
  type: additive
breaking_change: false
migration_required: true
compatibility_notes: >
  Additive RBAC tables and AdminAccount.role_id.
  Existing admin accounts migrate to seeded super_admin.
  GET /admin/me gains permissions[]; old clients ignore unknown fields.

entities:
  - name: AdminRole
    before: null
    after:
      fields: [id, name, system, created_at]
  - name: AdminPermission
    before: null
    after:
      fields: [code]
      catalog:
        - admin.users.read
        - admin.users.membership.grant
        - admin.users.ask_quota.grant
        - admin.orders.read
        - admin.audit.read
        - admin.analytics.read
        - admin.content.write
        - admin.roles.read
        - admin.roles.write
  - name: AdminAccount
    before:
      fields: [id, username, password_hash, status]
    after:
      fields: [id, username, password_hash, status, role_id]

apis:
  - method: GET
    path: /api/v1/admin/roles
    change: added
  - method: GET
    path: /api/v1/admin/roles/{id}
    change: added
  - method: PUT
    path: /api/v1/admin/roles/{id}/permissions
    change: added
  - method: GET
    path: /api/v1/admin/me
    change: modified
    response_delta: "add role + permissions[]"

security_impact:
  - "RequirePermission on mutating admin routes"
  - "403 + AuditLog on deny"

observability_impact:
  - "AuditLog on roles.permissions.update and permission denials"