3.2 Roles and permissions

Role	Can do
General_User	fill in / submit release tickets (after the cutoff time only a Deploy_User / Admin can file a late ticket); edit the release tickets and their details (including the "order" field) that they created and that have not yet merged successfully; query release records; add / edit / delete Config Server changes
Deploy_User	everything General_User can + test merge / production merge, trigger deploy (Jenkins), the release-feedback panel (restricted in the front-end only, not enforced by the backend)
Admin	all of the above + the full /admin back office (systems and Jenkins jobs, users and roles, AD login groups and cutoff, Git / Jenkins credentials, API keys, deployment windows), and can edit / view any release ticket regardless of creator or merge state

Note: the /releases, release-feedback, Config Server, deployment-window and deployment-dependency APIs have no role-check middleware on the backend — on the pages these actions are merely hidden behind v-if="auth.canDeploy", so a General_User calling the API directly can still perform them. The only role restrictions enforced on the backend are RequireAdminRole (all of /admin/*) and RequireDeployRole (the trigger-deploy endpoint and the merge endpoints).