Permission codes the API actually checks, grouped by module.
This catalog is read-only here. Grant or revoke codes through Roles. Audit Logs record who changed role assignments.
Codes are listed for auditability. Assignment happens on the Roles page.