FlatApp back office

8 roles, 32 capabilities in the permission matrix; the service desk manages 25 of them.