Permissions are enforced by the backend on each protected action. Named role groups and role editing are planned; the table shows current per-staff grants.