Why we gate on permissions, not roles

A person might be an 'assessor' at one institution and a 'trainer' at another, with different powers at each. If we gated screens by role name, that person would need workarounds — or a second account.

One user, many contexts

Instead, every screen checks a permission key. A user holding roles at two institutions is a first-class case, not an edge case. Switch context from the header and the navigation reshapes itself to what you can actually do.