ACL Manager

Supervised least privilege. AI may propose; a human Confirms. Chaos is not amplified.

What it is

Packages native groups into roles, selection grants, model guards and checkpoints. Inspired by OCA user roles, not a fork. Settings-only.

What it does

Roles with dated assignments.
Migrate then align on live databases.
Selection grants — pick records without master menus.

Model guards — close ORM leaks menus do not hide.
Checkpoints before align/migrate.
Suggest names on the Seal catalog (module agent, no Chatboo skill).

What it does not do

Does not lock production on install. Grant stays off until you choose.
Chatboo must not imitate align with raw CRUD — only the trusted action.

Where to configure

ACL Manager app (Settings administrators).