parent_scope, scope_mods and scope_read_only claims so the UI adapts automatically; the API enforces the subtractions on every request.{
"name": "Platform Manager",
"parent-scope": "Super User",
"description": "Ops admin — no platform config or routing changes",
"read-only": "no",
"modifications": {
"nsconfig": "none",
"route": "ro",
"device": "no-delete",
"phonenumber": "update-only"
},
"enabled": "yes",
"built-in": "yes"
}