Capabilities — org grant matrix

Tenant-wide view of who has what. Each row is a user; each column is a capability. Cells: G explicit grant, R via role floor, D explicit deny, — not granted. Click a user's name to edit their grants in the /users slide-over.

Trust note: this view is read-only. All grant/revoke happens via /users#caps (audit-logged) or `safecadence capabilities grant` (also audit-logged). Hover any cell for the role + history detail.