Domain Glossary

Core Terms

Highest-privilege admin role. Exactly one canonical owner must exist at all times.

Hidden technical support account used for break-glass access and operational recovery.

Runtime policy controlling whether /register can create additional admin users after owner bootstrap.

Account that cannot be deleted/demoted through self-service flows (support + canonical owner).

Shared @cms/crud service abstraction combining schema validation, repository orchestration, and audit hooks.

RBAC access scope granularity: own, team, global.

TODO.md in repository root. Rendered in admin via /todo.

Public-site announcement strip configured through system_setting key public.header_banner.