Default-deny access for Lummet staff

Access control that starts open has to be closed one door at a time. Lummet starts closed.

The model

A super admin can do everything. Every other account begins with no brands and no permissions. Access is granted in two layers: which brands the person may act on, and which of create, read, update and delete they hold on each resource.

Enforced on the server

Hiding a menu link never stops a direct request, so every route that touches a brand's content, the Lummet site content or the registry checks the grant itself. The navigation only reflects what the server would allow.

Guardrails

• An admin cannot change their own role or disable or delete themselves.
• The last remaining super admin cannot be demoted or deleted.
• Disabling an account ends its sessions immediately.