{
  "version": "1.0.0",
  "description": "Fineract / OMNL separation-of-duties matrix — four super admins, three Fineract service accounts",
  "tenant": "omnl",
  "officeId": 24,
  "superAdmins": [
    { "id": "sa-office24", "fineractUser": "ali_hospitallers_admin", "portalCtid": 5825 },
    { "id": "sa-exchange", "fineractUser": "ali_hospitallers_operator", "portalCtid": 5826 },
    { "id": "sa-secure", "fineractUser": "ali_hospitallers_admin", "portalCtid": 5827 },
    { "id": "sa-forex", "fineractUser": "ali_hospitallers_operator", "portalCtid": 5828 }
  ],
  "fineractUsers": [
    {
      "username": "ali_hospitallers_tenant",
      "role": "tenant_api",
      "permissions": ["journal_read", "journal_post", "money_supply_read"]
    },
    {
      "username": "ali_hospitallers_admin",
      "role": "office_admin",
      "permissions": ["journal_post", "office_config", "settlement_approve", "super_admin_portal"]
    },
    {
      "username": "ali_hospitallers_operator",
      "role": "operator",
      "permissions": ["journal_post", "transfer_initiate", "swap_settle", "super_admin_portal"]
    }
  ],
  "separationOfDuties": {
    "journalPostRequires": ["tenant_api", "office_admin", "operator"],
    "materialOpeningRequires": ["office_admin", "head_office_dual_control"],
    "tokenLoadRequires": ["super_admin_portal"],
    "externalTransferRequires": ["super_admin_portal", "compliance_screening"]
  },
  "customerApi": {
    "role": "customer",
    "permissions": ["quote_read", "token_list", "swap_plan", "swap_execute"],
    "denied": ["token_load", "transfer_internal", "transfer_external", "swap_settle", "money_supply_admin"]
  }
}
