Settings
System-wide configuration surfaces for Ops — configs, access, flags, schedules, and table columns.
Roles & Permissions
Per-role ability matrix over the CASL permission catalog. Edits apply on the next request (ability caches are invalidated server-side).