04 — Human-Org-Role / Permission Framework (G2) — Result: Review-Ready

Result: ADVANCED to review-ready. A framework law + registry path + Directus/Nuxt/Mother-visibility mapping is specified. No enactment, no registry committed (a role registry would itself be a governed collection birth subject to the same meta_catalog cascade/guard reversibility issue as G1 — deferred to the human birth window).

1. Gap (live)

• governance_registry (9 rows): council/system/factory only — 0 human-org-role rows. Điều 37 currently encodes no human roles or permission verbs.
• Blocks MOW-UI and any 4 Mothers operator/approver UI; does NOT block the IU pilot (pilot is operator-script driven, doc 08).

2. Proposed role law (review-ready)

Roles: staff, dept_lead, super_admin, council, sovereign, agent (non-human, never-approver). Verbs: view, edit, approve, delegate, escalate. Matrix (illustrative, for council review):

role	view	edit	approve	delegate	escalate
staff	own-scope	own-scope	—	—	✓
dept_lead	dept	dept	dept (non-final)	✓	✓
super_admin	all	all	operational	✓	✓
council	all	governance	final (cross-sign)	✓	—
sovereign	all	all	override	✓	—
agent	scoped	scoped via DOT	never	—	✓

Hard rule: approve (final) is human/council/sovereign only; agent can never hold approve (aligns with Điều 32 + doc 03).

3. Registry path (DDL spec — not committed)

A human_org_role registry collection (born under Điều 0-G/36/37) + a role_permission_grant mapping (role × verb × scope × collection). Same lawful birth sequence proven in doc 01. Committing deferred to the human certification window (avoids uncertified governed-collection footprint).

4. Directus policy mapping (Điều 36/37)

Each role → a Directus policy (permissions per collection/action). approve actions map to a Directus flow gated on cutter_governance cross-sign, not a raw field write. agent maps to a token-scoped policy with DOT-only write paths (no direct table writes).

5. Nuxt/template mapping (Điều 28, document-only)

Role-aware nav + a governance cockpit (read-only data model in doc 09/11) rendered from governance_registry + the role registry. No UI implementation (forbidden). Templates only; no component build.

6. 4 Mothers visibility/edit/approve/delegate/escalate

• MOW/MOT/MOIT/MOUT config: dept_lead+ may propose; council approves activation; agent may draft via DOT but never activate.
• Output proposals: emitted as mother.proposal.created (doc 05) → reviewed under the role matrix → mother.proposal.approved/rejected.

7. Remaining (human-only)

Council/sovereign enactment of the role law + Điều 32 certification of the role registry birth. No conflict with current Điều 37 (additive). G2 is the gating dependency for all Mother UI and prod review_decision UX.