Budget gate, per-Purpose budget caps, outreach opt-in matrix, and RBAC grants.
One row per Purpose. Amount is the monthly cap in USD. Leave empty to rely on the global budget_gate_posture only.
One row per AdminRole. Permissions are comma-separated AdminPermission identifiers (e.g. INFERENCE_WRITE, EMBEDDING_WRITE).