{
  "permissions": "Permissions",
  "permissionsDesc": "Add or remove capabilities per role. Factory defaults with one-click restore.",
  "rolePolicy": "Role policy",
  "dirty": "Customized",
  "factory": "Factory default",
  "maxLevel": "Max level",
  "save": "Save policy",
  "saved": "Saved {{role}} policy",
  "restoreRole": "Restore this role",
  "restoreAll": "Restore all roles",
  "restoreRoleTitle": "Restore {{role}} to factory defaults?",
  "restoreRoleDesc": "Custom capabilities for this role will be cleared.",
  "restoreAllTitle": "Restore all roles to factory defaults?",
  "restoreAllDesc": "All custom role policies will be cleared.",
  "restoredRole": "Restored {{role}}",
  "restoredAll": "Restored all role defaults",
  "bandAllOn": "Enable all",
  "bandAllOff": "Disable all",
  "diffFromFactory": "Differs from default",
  "effectivePreview": "Effective capabilities",
  "userOverrides": "User overrides",
  "extraGrants": "Extra grants",
  "extraRevokes": "Extra revokes",
  "restoreUserOverrides": "Clear user overrides",
  "restoreUserOverridesTitle": "Clear overrides for {{name}}?",
  "restoreUserOverridesDesc": "Only extra grants/revokes are cleared; role policy is unchanged.",
  "overridesBadge": "Overrides",
  "promoteAdminTitle": "Promote to Admin?",
  "promoteAdminDesc": "Admin can manage users, change RBAC, impersonate, restore backups, and more.",
  "level": {
    "read": "Read",
    "write-low": "Write (low)",
    "write-high": "Write (high)",
    "destructive": "Destructive",
    "privilege": "Privilege"
  },
  "cap": {
    "dashboardRead": "Dashboard",
    "logsRead": "Logs",
    "metricsRead": "Metrics",
    "projectsRead": "Projects (read)",
    "mailRead": "Mail (read)",
    "dnsRead": "DNS (read)",
    "sslRead": "SSL (read)",
    "backupsRead": "Backups (read)",
    "updatesRead": "Updates (read)",
    "servicesRead": "Services (read)",
    "firewallRead": "Firewall (read)",
    "approvalsView": "Approvals (view)",
    "usersSelf": "Self profile / 2FA",
    "projectsWrite": "Projects create/edit",
    "mailWrite": "Mailboxes / aliases",
    "dbWrite": "Create databases",
    "sslUpload": "Upload certificates",
    "filesProject": "Project files",
    "approvalsRespond": "Respond to approvals",
    "cronManage": "Cron management",
    "servicesControl": "Service control",
    "updatesApply": "Apply package updates",
    "dnsApply": "Apply DNS",
    "sslIssue": "Issue SSL",
    "publishApply": "Publish / Nginx",
    "firewallEdit": "Edit firewall",
    "mailApply": "Apply mail maps",
    "runtimeTuning": "Runtime tuning",
    "mysqlConsoleWrite": "MySQL write console",
    "projectsDelete": "Delete projects",
    "dbDrop": "Drop databases",
    "backupsRun": "Run backups",
    "backupsRestore": "Restore backups",
    "firewallFlush": "Flush firewall",
    "logsPurge": "Purge logs",
    "usersManage": "Manage users",
    "packagesManage": "Manage packages",
    "usersImpersonate": "Impersonate",
    "securityPolicy": "Security policy",
    "rbacPolicy": "RBAC policy",
    "settingsSystem": "System settings",
    "auditExport": "Audit export",
    "securityApiKeysAdmin": "API keys admin",
    "networkBrowse": "Host-mediated web browse",
    "networkVnc": "VNC remote desktop",
    "validatorsRead": "Validators (read)",
    "validatorsManage": "Validators manage",
    "validatorsWipe": "Validators wipe data",
    "dockerRead": "Docker (read)",
    "dockerManage": "Docker manage",
    "dockerWipe": "Docker wipe / prune"
  },
  "aboutRoles": "Roles (factory defaults)",
  "aboutRolesBody": "Roles set default capabilities; users can override individual ones.",
  "aboutQuota": "Quotas",
  "aboutQuotaBody": "Package quotas are primarily host/panel totals, not hard multi-tenant isolation",
  "dangerPolicyTitle": "Grant destructive / privilege capabilities?",
  "dangerPolicyDesc": "You are adding destructive or privilege caps, or raising maxLevel for this role",
  "needRbacPolicy": "rbac.policy is required to edit role policies.",
  "adminLockedFull": "Admin full-open (locked)",
  "adminLockedHint": "The admin system role is always fully open and cannot be reduced",
  "maxLevelHint": "Capability groups above this level stay locked.",
  "capabilities": "Capabilities",
  "capabilitiesHint": "Toggle what this role may do",
  "enabledCount": "{{enabled}} of {{total}} enabled",
  "bandAboveMax": "Above max level",
  "roleUnavailable": "Not available for this role",
  "dirtyHint": "Customized (differs from factory)",
  "unsaved": "Unsaved",
  "unsavedHint": "Unsaved edits on this role",
  "nothingToSave": "Nothing to save",
  "saveRole": "Save {{role}} policy",
  "discardTitle": "Discard unsaved changes?",
  "discardDesc": "Unsaved permission edits will be discarded."
}