- Shipped
- April 19, 2026 at 9:50 PM UTC
- Author
- Kamo
- Commit
- 38b9248
provisionMaxedOutMasterModel now populates the Administrator template with every RoleRightType set to GRANTED. The other three templates (Team Member, Member, DEFAULT) still materialize with zero rights (NOT_SPECIFIED for everything), matching the intended blank baseline for non-admin roles. Why GRANTED (not FORCE_GRANTED): at child-org creation time ChildOrgTemplateSeedingService copies non-force template values into the new org's OrgRoleRight rows, so a GRANTED admin template gives every new child org a ready-to-use admin role with full permissions that the owner can still edit. FORCE_GRANTED would lock rights at runtime and hide them from the security-roles editor, which we don't want for the admin template baseline.