Capability classes for the ops plane, and the table that tags every route with exactly one of them (ADR 0007).

read is everything non-mutating, player_data acts on one identified player's data (ban, grant, broadcast, roster edits, and the full export of one account), config is economy definitions, credentials and deploy-adjacent settings. erasure is player erasure and nothing else. The only authorisation decision anywhere in the plane is membership of a route's class in the actor's caps.

erasure is its own class for one reason, and it is not sensitivity: it is the only irreversible one. An erased account cannot be un-erased by a second call the way a ban can be lifted, so it does not belong in the same grant as "give this player 100 coins" - and asobi_console_session hands a browser every other class by default.

Role names are deliberately absent. They are not stable wire surface - capability classes are, and a further class later is additive the same way erasure was. asobi_saas maps its own roles onto these classes once, at token-mint time, so the string "owner" never reaches this plane.

A route with no entry in classes/0 has no class and authorised/2 denies it, so an untagged or mis-mounted route is closed rather than open.