feat: add stage 0 foundation

backend/apps/accounts/permissions.py

@@ -0,0 +1,61 @@
+from dataclasses import dataclass
+
+
+@dataclass(frozen=True)
+class PermissionSpec:
+    codename: str
+    name: str
+
+
+PERMISSIONS: tuple[PermissionSpec, ...] = (
+    PermissionSpec("ticket.view", "View tickets"),
+    PermissionSpec("ticket.create", "Create tickets"),
+    PermissionSpec("ticket.edit", "Edit tickets"),
+    PermissionSpec("ticket.export", "Export tickets"),
+    PermissionSpec("ticket.assign", "Assign tickets"),
+    PermissionSpec("ticket.close", "Close tickets"),
+    PermissionSpec("knowledge.view", "View knowledge"),
+    PermissionSpec("knowledge.manage", "Manage knowledge"),
+    PermissionSpec("solution.view", "View solutions"),
+    PermissionSpec("solution.manage", "Manage solutions"),
+    PermissionSpec("agent.use", "Use Agents"),
+    PermissionSpec("agent.manage", "Manage Agents"),
+    PermissionSpec("model.manage", "Manage model configs"),
+    PermissionSpec("tool.manage", "Manage MCP tools"),
+    PermissionSpec("audit.view", "View audit logs"),
+    PermissionSpec("system.manage", "Manage system settings"),
+)
+
+DEFAULT_GROUPS: dict[str, tuple[str, ...]] = {
+    "System Admin": tuple(permission.codename for permission in PERMISSIONS),
+    "Knowledge Admin": (
+        "ticket.view",
+        "knowledge.view",
+        "knowledge.manage",
+        "solution.view",
+        "solution.manage",
+        "agent.use",
+    ),
+    "Support Engineer": (
+        "ticket.view",
+        "ticket.create",
+        "ticket.edit",
+        "ticket.assign",
+        "ticket.close",
+        "knowledge.view",
+        "solution.view",
+        "agent.use",
+    ),
+    "Requester": (
+        "ticket.view",
+        "ticket.create",
+        "knowledge.view",
+        "solution.view",
+    ),
+    "Auditor": (
+        "ticket.view",
+        "knowledge.view",
+        "solution.view",
+        "audit.view",
+    ),
+}