-- ============================================================
-- IPS — Per-user permissions (UI-enforced RBAC)
-- Run once against `ips_db` (e.g. via phpMyAdmin).
-- Stores a JSON array of permission keys per user, e.g.
--   ["calls.make","contacts.view","contacts.import"]
-- NULL  = fall back to the role's default permissions (client-side).
-- Enforcement is UI-only; the API does not check these.
-- ============================================================

ALTER TABLE users
  ADD COLUMN permissions TEXT NULL AFTER specialization;
