{"id":"client_role_access_matrix_pack_company_bellezapro_brand_bellezapro","companyId":"company_bellezapro","brandId":"brand_bellezapro","brandName":"BellezaPro","format":"markdown","content":"# Client Role Access Matrix Pack local-only - BellezaPro\n\n- Estado: CLIENT_ROLE_ACCESS_MATRIX_PACK_READY_LOCAL_ONLY\n- Access mode: READ_ONLY_CLIENT_VIEW_WITH_INTERNAL_OPERATORS\n- Tenant scope: COMPANY_LEVEL_RLS\n- Empresa: BellezaPro\n- Marca: BellezaPro\n- Production readiness: BLOCKED_BY_SECURITY_GATE\n- NO_CUSTODY_OF_FUNDS: true\n\n## Roles\n\n- client_viewer: Client viewer read-only (READ_ONLY_CLIENT_VIEW)\n- client_business_owner: Client business owner read-only reviewer (READ_ONLY_CLIENT_VIEW)\n- altiropay_operator: Internal operator local-only (INTERNAL_LOCAL_OPERATOR)\n- altiropay_admin: Internal admin local-only (INTERNAL_LOCAL_ADMIN)\n- qa_reviewer: QA reviewer local-only (INTERNAL_QA_REVIEW)\n\n## Matriz de acceso\n\n- view_client_portal: client=ALLOW_READ, operator=ALLOW_READ, admin=ALLOW_READ, qa=ALLOW_READ\n- view_sanitized_evidence: client=ALLOW_READ, operator=ALLOW_READ, admin=ALLOW_READ, qa=ALLOW_READ\n- create_provider_account: client=DENY, operator=REQUEST_ADMIN, admin=ALLOW_LOCAL_WRITE, qa=DENY\n- configure_payment_methods: client=DENY, operator=ALLOW_LOCAL_WRITE, admin=ALLOW_LOCAL_WRITE, qa=READ_REVIEW\n- create_sandbox_runs: client=DENY, operator=ALLOW_LOCAL_WRITE, admin=ALLOW_LOCAL_WRITE, qa=ALLOW_REVIEW_RUN\n- promote_evidence: client=DENY, operator=ALLOW_LOCAL_WRITE, admin=ALLOW_LOCAL_WRITE, qa=ALLOW_REVIEW\n\n## Evidencia requerida\n\n- client_portal_read_only: Portal cliente en READ_ONLY_CLIENT_VIEW (CLIENT_PORTAL_READY_READ_ONLY_LOCAL) /growth-platform/client-portal/company_bellezapro\n- tenant_isolation_review: Tenant isolation review con COMPANY_LEVEL_RLS (TENANT_ISOLATION_REVIEW_READY_LOCAL_ONLY) /api/growth-platform/tenant-isolation-review?companyId=company_bellezapro&brandId=brand_bellezapro&format=markdown\n- security_preflight: Security Gate Preflight local antes de ampliar acceso (REQUIRED_BEFORE_PRODUCTION) /api/security/preflight\n\n## Bloqueos\n\n- view_raw_credentials: Ver credenciales o secretos (PROHIBITED)\n- enable_production: Habilitar produccion o live access (BLOCKED_BY_SECURITY_GATE)\n- edit_from_client_portal: Editar configuracion desde portal cliente (PROHIBITED_READ_ONLY_CLIENT_VIEW)\n- approve_custody: Aprobar custodia, saldos o liquidacion AltiroPay (PROHIBITED)\n- cross_company_access: Acceder a otra empresa o marca fuera del tenant (PROHIBITED)\n","productionReadiness":"BLOCKED_BY_SECURITY_GATE","productionEnabled":false}