Variable ROLES`Const`

ROLES: readonly ["viewer", "auditor", "operator", "policy-author", "policy-approver", "tenant-admin"] = ...

Roles, least to most privileged. There is no standing production write role for humans.