Roles & PermissionsSuperadmin vs. tenant user, and the per-collection rule engine that actually governs API access.