M0 · Foundation
Settings
Org administration. Each section is gated by the same can() helper the rest of the platform uses — no parallel permission path.
Organization
Name, slug, sub-orgs.
Workspaces
Create + manage workspaces.
Members
Invite, roles, client grants.
Theme
Brand tokens (WCAG-validated on save).
Domains
Custom hostnames + CNAME status.
Entitlements
Module × seat allocation.
Audit
Append-only audit trail.