List roles
access-control
List roles
The seeded/operator-authored roles as full RoleDefinition-shaped bodies
({name, description, scopes, condition, condition_id, condition_kwargs, base_tier, allow_all, grants}) — the users-admin role picker and the Studio Roles page read
this. A store-less deployment (no versioned store configured) has no roles — the seed
step is skipped at boot — so the read is skipped and the list is empty.
Admin-only: a listing exposes every role’s raw base-tier jq condition, so a non-admin
caller is denied 403. This op-level check is defense in depth behind the secret
route action-class that already fences the route.

