{
  "schema_version": "scola.t2.1.w01.session-read-scope.v1",
  "workflow": "W01",
  "model": "op.session",
  "authority": "server-derived from authenticated active-role only; FE filters never widen",
  "base_scope": "company / school-profile companies via _company_domain",
  "roles": {
    "school_admin": {
      "active_roles": ["admin", "school_admin", "head_admin", "admin_staff", "principal", "vice_principal_curriculum"],
      "read_scope": "company",
      "notes": "Same set as _can_manage_academic schedule managers; company-wide timetable read"
    },
    "teacher": {
      "active_roles": ["teacher", "guru"],
      "read_scope": "own_faculty_sessions",
      "domain": "faculty_id = caller's op.faculty",
      "notes": "Assigned inactive roles must not widen; no faculty_id/batch_id query widening"
    },
    "homeroom": {
      "active_roles": ["homeroom"],
      "read_scope": "own_faculty_sessions OR sessions on homeroom batches",
      "domain": "faculty_id = me OR batch_id in resolve_homeroom_batch_ids",
      "notes": "Active role homeroom only — not union of assigned teacher+homeroom when active_role=teacher"
    },
    "student": {
      "active_roles": ["student"],
      "read_scope": "self_batch_if_linked",
      "domain": "batch_id in student's current/enrolled batches; empty if unlinked",
      "notes": "W02 enrollment linkage residual — empty scope is fail-closed, not school-wide"
    },
    "parent": {
      "active_roles": ["parent"],
      "read_scope": "linked_children_batches_if_available",
      "domain": "batch_id in linked children's batches; empty if unlinked",
      "notes": "FIXTURE_DATA residuals remain non-blocking for W01"
    },
    "principal": {
      "active_roles": ["principal", "vice_principal_curriculum"],
      "read_scope": "company",
      "notes": "Already in manage set; do not invent extra broadening"
    },
    "other": {
      "read_scope": "deny_empty",
      "domain": "[('id','=',0)]",
      "notes": "Unknown/empty active role → no timetable disclosure"
    }
  },
  "endpoints": [
    "/api/v1/academic/sessions/list",
    "/api/v1/academic/sessions/count",
    "/api/v1/academic/sessions/get"
  ],
  "denial_semantics": "access_denied / empty without leaking other-teacher name, class, subject, or session details",
  "filter_policy": "Caller-supplied faculty_id/batch_id are ANDed inside actor scope; never replace actor scope"
}