KemalIdentity::Authz::PermissionRegistry

Every permission this application knows about, declared at boot.

Why an unknown permission is refused rather than denied quietly

authorize!("invoices.refnud") is a typo, and a typo must not be indistinguishable from a correctly-spelled permission nobody holds. Both deny — the registry fails closed — but the denial reason is UnknownPermission, and RoleCatalog refuses at boot when a role grants a permission that was never declared.

That is the whole reason this type exists. Without it, a rename that updates the role definitions and misses one call site produces an application that denies an action forever and looks like it is working.