Constructive Access Control

The access control model — how users get capabilities, how roles and profiles organize them, and how access composes across scopes. This skill covers the semantic layer: what access means in a Constructive app, how to configure it via blueprints and the ORM, and how the different layers (roles, profiles, grants, defaults) compose into effective access.

Naming: a capability is the named unit of access — every table, column, ORM model, blueprint argument, and module name uses that spelling (appCapability, capabilities_module, capabilities: […]). Permission appears only as a value of a capability's kind column, distinguishing a granted access right from an earned trust level.

For application UI, the App access and Organizations feature packs expose the corresponding membership, invitation, profile, capability, and default-management surfaces. Use constructive-blocks for installation, standalone host contracts, and Console module discovery and adapters; this skill remains the authority for access semantics.

When to Apply