feat(rbac): support inherited permission overrides

README.md

@@ -105,7 +105,19 @@ and both support a hierarchy:
 - A permission can **also grant** other permissions. Holding `membership:write` can grant
   `membership:read` without listing it everywhere.
 - A role can **inherit from** other roles. It then carries every permission of its parents,
-  including what those inherit in turn.
+  including what those inherit in turn. In the editor, inherited permissions are already
+  checked and labeled **Inherited**; explicit grants are labeled **Direct**. Unchecking an
+  inherited or implied permission creates an **Override**, highlighted in amber. **Use
+  inherited** clears the override. Overrides are saved with the role and follow its
+  descendants, without changing the parent or sibling roles. Another independently held
+  role can still grant an excluded permission. Essential read access required by managed
+  write/assign permissions cannot be excluded while that capability remains enabled.
+
+Role member counts and lists include people assigned to descendant roles, once per person.
+For example, someone assigned Trusted Admin also counts under Admin when Trusted Admin
+inherits from Admin. Inherited members show their source roles; remove an assignment on
+that source role to revoke the inherited membership. This follows hand-made assignments;
+managed memberships continue to be determined from identity evidence at sign-in.
 
 Both hierarchies are transitive, and the editor refuses an edge that would make two roles
 inherit from each other or two permissions grant each other.

drizzle/0022_role_permission_overrides.sql

@@ -0,0 +1 @@
+ALTER TABLE "role_permission" ADD COLUMN "granted" boolean DEFAULT true NOT NULL;