# Permission group akP-media-cheeztv (name = filename). Per-service entitlement
# for the kids ("cheeztv") media tier. Bound to the jellyfin application, so it
# gates Jellyfin SSO access: only members (via akR-media-adult or akR-media-kids)
# may authorize. It also appears in the user's hierarchical `ak_groups` claim,
# which the media proxy reads to route/authorize the cheeztv backend.
application: jellyfin