ALTER TABLE gateway.admin_accounts
    ADD COLUMN IF NOT EXISTS permissions text[] NOT NULL DEFAULT '{}';

ALTER TABLE gateway.portal_users
    ADD COLUMN IF NOT EXISTS role varchar(24) NOT NULL DEFAULT 'member',
    ADD COLUMN IF NOT EXISTS permissions text[] NOT NULL DEFAULT '{}';

COMMENT ON COLUMN gateway.admin_accounts.permissions IS
    'Direct RBAC permission grants. Built-in role permissions are resolved in the application.';
COMMENT ON COLUMN gateway.portal_users.permissions IS
    'Direct portal permission grants using the same resource:action convention.';