# Role akR-media-kids (name = filename): kids media tier. Kids reach only the
# kids ("cheeztv") service, so this role nests just that per-service entitlement.
# Membership propagates child -> parent, so a member appears in akP-media-cheeztv
# in the hierarchical `ak_groups` claim and the media proxy routes/authorizes
# them for cheeztv only (never fafflix).
permissions:
  - akP-media-cheeztv