Access in solarOS is permission-key based (e.g. nav.sales.view, settings.api-keys.manage, as seen elsewhere in these docs), resolved per-user in apps/web/src/lib/permissions.ts. OWNER is a hard bypass: an Owner passes every permission check without a database lookup, while every other role's access is resolved from granted permission keys. Top-nav module visibility, Settings sections, and individual actions (like creating an API key) are all gated by specific permission keys, not by role name directly.

TODO(owner, likely product + engineering): write the full page from apps/web/src/lib/permissions.ts and the apps/web/src/lib/permissions/ directory. Enumerate the base roles below OWNER, explain how custom roles interact with base roles (a project memory note flags this as an area with real product ambiguity; confirm current behavior in code rather than assuming), and link to the generated permissions matrix instead of duplicating its table.