An editable roles × permissions grid: tri-state cells (allow / deny / inherit), collapsible permission groups, a pinned permission column, locked system-role columns, row/column bulk edits, and real loading/empty/error states.