rbaclisted

# RBAC ## Usage ``` rbac [app] [requirements] ``` - Zero args → use the current repository and its documented RBAC requirements. - `[app]` → application name or path. - `[requirements]` → additional RBAC requirements stated in plain language. Use `$ARGUMENTS` as the optional target application or additional RBAC requirements. Resolve the target and incorporate any supplied requirements before reviewing or changing documentation. Update RBAC documentation and implementation for comprehensive role coverage. Execution steps: 1. **Identify application context**: - Determine which application from workspace or $ARGUMENTS - Load application-specific resource requirements - Identify application name for documentation (e.g., "Example App", "Operations Portal", "Scheduling App") 2. **Update RBAC documentation**: - **`docs/template/RBAC.md` is a pure template copy.** `spernakit-diff-sync` requires everything under `docs/template/` to be byte-identical to the template, with no branding substitutions. **Never** update application-name references or add app-specific resources inside it in a derived app; `check:drift` will revert such edits. Only edit this file when working in the Spernakit template repository itself. - Document application-specific RBAC details **outside** `docs/template/` (e.g., `docs/internal/RBAC.md`): the app's resource list, app-specific permission matrix rows, and application-name-specific examples. - In whichever document applies (te