ALTER TABLE users
  ADD COLUMN ban_reason text,
  ADD COLUMN banned_until timestamptz;

CREATE TABLE user_permissions (
  user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
  permission text NOT NULL CHECK (permission IN (
    'users.read',
    'users.write',
    'cards.manage',
    'operations.manage',
    'e.manage',
    'audit.read',
    'licenses.manage'
  )),
  granted_by uuid REFERENCES users(id),
  created_at timestamptz NOT NULL DEFAULT now(),
  PRIMARY KEY (user_id, permission)
);

CREATE INDEX user_permissions_permission_idx ON user_permissions(permission, user_id);