diff --git a/config/permissions/akP-media-cheeztv.yaml b/config/permissions/akP-media-cheeztv.yaml
new file mode 100644
index 0000000..388b63e
--- /dev/null
+++ b/config/permissions/akP-media-cheeztv.yaml
@@ -0,0 +1,6 @@
+# Permission group akP-media-cheeztv (name = filename). Per-service entitlement
+# for the kids ("cheeztv") media tier: NOT bound to any application (no
+# `application` field), so it does not gate OIDC. It exists purely to appear in
+# the user's hierarchical `ak_groups` claim, which the media proxy reads to
+# decide whether to route/authorize the cheeztv backend.
+attributes: {}
diff --git a/config/permissions/akP-media-fafflix.yaml b/config/permissions/akP-media-fafflix.yaml
new file mode 100644
index 0000000..366e18f
--- /dev/null
+++ b/config/permissions/akP-media-fafflix.yaml
@@ -0,0 +1,6 @@
+# Permission group akP-media-fafflix (name = filename). Per-service entitlement
+# for the adult ("fafflix") media tier: NOT bound to any application (no
+# `application` field), so it does not gate OIDC. It exists purely to appear in
+# the user's hierarchical `ak_groups` claim, which the media proxy reads to
+# decide whether to route/authorize the fafflix backend.
+attributes: {}
diff --git a/config/roles/akR-media-adult.yaml b/config/roles/akR-media-adult.yaml
new file mode 100644
index 0000000..16f88e2
--- /dev/null
+++ b/config/roles/akR-media-adult.yaml
@@ -0,0 +1,8 @@
+# Role akR-media-adult (name = filename): adult media tier. Adults reach both the
+# adult ("fafflix") and kids ("cheeztv") services, so this role nests both
+# per-service entitlements. Membership propagates child -> parent, so a member
+# appears in both permission groups in the hierarchical `ak_groups` claim and the
+# media proxy routes/authorizes them for fafflix and cheeztv.
+permissions:
+  - akP-media-fafflix
+  - akP-media-cheeztv
diff --git a/config/roles/akR-media-kids.yaml b/config/roles/akR-media-kids.yaml
new file mode 100644
index 0000000..7882eb3
--- /dev/null
+++ b/config/roles/akR-media-kids.yaml
@@ -0,0 +1,7 @@
+# Role akR-media-kids (name = filename): kids media tier. Kids reach only the
+# kids ("cheeztv") service, so this role nests just that per-service entitlement.
+# Membership propagates child -> parent, so a member appears in akP-media-cheeztv
+# in the hierarchical `ak_groups` claim and the media proxy routes/authorizes
+# them for cheeztv only (never fafflix).
+permissions:
+  - akP-media-cheeztv