The five built-in roles are fixed and shown read-only for reference. Create custom roles with their own per-tab read/write access. Each custom role inherits a built-in role as its security floor. The matrix can only tighten access, never widen it past the floor (the database stays the hard boundary).