Module Access Control

Module Access Control

Module access has two layers:

1. Workspace enabled state: onboarding bundles and the Module Store determine whether a module is selected for the workspace.
2. Role visibility: role permissions determine which roles can see or use that enabled module. Current roles are super_admin, manager, agent.

An access grant can unlock a module for a role without changing the bundle selection. An explicit administrator denial wins over a grant. Member-gated modules also follow their organization-size gate. The mandatory modules are wrrkspace, organization, ai-hub, ai and cannot be disabled.