- Shipped
- August 12, 2026 at 2:08 AM UTC
- Author
- Kamo
- Commit
- ad905f5
Split so separation of duties is expressible: whoever approves a timecard is not automatically whoever may close a pay period over it. MANAGE_TIMECARDS (183) stays the module gate and is deliberately neither. Enrollment is still NOT a right -- it is a persisted employment fact. A right leaks ON through four shipped behaviours and vanishes from a TERMINATED member exactly when HR must produce their final timecard. Deliberately absent from NEW_RIGHT_SEEDS: that carries an EXISTING grant forward, and these gate a capability nobody had. Adding a right needs only a SecurityService restart -- no KamoInitializer pass, no DDL. Ids pinned by a test, because the id is what member_rights_applied stores.