# Role akR-global-admin (name = filename): full admin across all onboarded apps.
permissions:
  - akP-grafana-admin
  - akP-argocd-admin
  - akP-rancher-admin
  - akP-litellm-admin
  - akP-jellyfin-admin
  # arrstack has no admin tier (it is a proxy front door); grant global admins
  # the front door plus every per-app entitlement so they reach all media apps.
  - akP-arrstack-user
  - akP-arrstack-sonarr
  - akP-arrstack-radarr
  - akP-arrstack-prowlarr