Studio
Collaboration
Roles for handoff, and the short list of things the studio actually refuses. The ship decision has exactly one owner by agreement; the gates below hold by code.
What is enforced
Access to the app
One shared password. Everything except /login, /api/login, and /api/health is refused without a session.
Master export
Refused unless a rubric pass is recorded on the cut. The decision is read from the store, never from the caller.
A roll entering a cut
Refused unless an approval is recorded against that roll on /dailies.
Spending money
A billable provider submit requires credentials and authentication independently of the access gate.
Per-role permissionsby agreement only
Not enforced. One shared session means anyone through the gate can reach every surface — the roles above are a working agreement, not a check.
Roles
Director
Only role that can record a ship decision.
Editor
Owns assembly and the caption lane.
Color
Grades inside the envelope; cannot widen it.
Sound
Realises the hierarchy, does not renegotiate it.
Producer
Moves work through stages; no grade access.