Role is the same as Users & auth → Roles in Studio: a name and the permissions it carries.
Deploy creates or updates the role. Roles are then used by
P.role("teacher") and P.permission("grades.write").
Giving roles to people
Roles on people (who is a teacher) are assigned in Studio under Users & auth → Users, or automatically with Roles for new accounts in Restrictions. They are data about users, not definitions, so they stay out of the IaC project.Stay consistent
Pick one separator for permission names (grades.write or grades:write) and use it everywhere; the permission check compares text exactly.
Policies
Use roles in rules.
Roles in Auth
Assign them.