Who can do what; how data is stored.
Roles: viewer (read + Assist), planner (run engines, approve proposals, override forecasts), admin (users, capability switchboard, org settings, demo reset). Sessions are httpOnly cookies; passwords are scrypt-hashed; every mutation is audit-logged (Settings → Audit).
Storage: PostgreSQL always — embedded (PGlite, in the app folder under .data/) by default, or your own PostgreSQL server via DATABASE_URL (a docker-compose.yml ships in the repo). Reset demo data any time from Settings.