standard:
  description: Typical domain access — analysts read curated/marts; loaders write landing/raw.
  analyst_zones_read: [curated, marts]
  loader_zones_write: [landing, raw]
  engineer_zones: [landing, raw, curated, marts]
restricted:
  description: Tighter domain — prod curated read requires explicit override + decision.
  analyst_zones_read: [marts]
  loader_zones_write: [landing, raw]
  engineer_zones: [landing, raw, curated]
  require_decision_for:
    - prod_curated_read