Captures the architectural decision behind isReader = !canWrite && !canAnnotate, why BLOG_WRITE intentionally lands on the reader dashboard, the alternatives considered (separate route, AppUser column, middleware redirect, BLOG_WRITE exclusion), and the implications for future permission additions. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>