Add System User flag + access-grant entity

Shipped

April 23, 2026 at 9:09 PM UTC

Author

Kamo

Commit

696e163

Introduces the platform-wide System User model: a User.isSystemUser flag (unique partial index enforces a singleton), plus a SystemUserAccess table that records which top-level-org departments, job titles, or team members may impersonate the System User to enter child orgs. Access rows are platform-internal (not RoleRightType entries) so they stay out of the tenant-facing rights surface.