Alex Power[s] BI (itsnotaboutthecell) · Oct 9, 2026 · Oct 9, 2026 · Oct 9, 2026
diff --git a/.gitignore b/.gitignore
@@ -12,3 +12,4 @@ sql/bin/
 sql/obj/
 examples/**/obj/
 examples/**/bin/
+/docs/superpowers/
diff --git a/README.md b/README.md
@@ -39,9 +39,9 @@ The check explains missing prerequisites without installing anything. The guides
 
 **Your application.** Work with your AI assistant to implement and test its screens and SQL behavior using the existing foundation. This is not a one-command generator. The default foundation has no Todo screen or sample data; examples are selected explicitly.
 
-**A useful first result.** Run the app, create a record, reload it, and make a change such as adding a field or filter. [Run locally](docs/guides/run-locally.md) explains the available startup paths and how to keep your data between sessions.
+**A useful first result.** Run the app, create a record, reload it, and make a change such as adding a field or filter. Implemented, built, running and workflow-verified are separate milestones; a launch URL is usable only after the intended server responds. [Run locally](docs/guides/run-locally.md) explains startup paths, scoped approvals and how to keep your data between sessions.
 
-**Sharing is optional.** Azure is the cloud target. Free tier means recurring allowances, not trial credits or unlimited usage. The current templates also include paid resources, and the minimal public-demo deployment workflow is not yet complete. Read [Sharing your app](docs/guides/sharing.md) and [Costs and growth](docs/guides/costs.md) before choosing a cloud path.
+**Sharing is optional.** Azure is the cloud target. Free tier means recurring allowances, not trial credits or unlimited usage. The explicit [role-based-data profile](docs/reference/role-based-data.md) starts SQL/DAB/browser locally and selects matching authenticated Azure resources without file/job services. Its private-network SQL deployment is paid and still needs live acceptance; the full foundation retains its existing services. The minimal public-demo workflow is incomplete, and its cost review is demo-only. Read [Sharing your app](docs/guides/sharing.md) and [Costs and growth](docs/guides/costs.md) before choosing a cloud path. Existing Azure resources are collision information, not permission to replace your new app with an older deployment.
 
 ## Find your next step
 

diff --git a/azure-role-based-cost.example.json b/azure-role-based-cost.example.json
@@ -0,0 +1,6 @@
+{
+  "version": 1,
+  "profile": "role-based-data",
+  "intent": "zero-azure-spend",
+  "acknowledgeFixedCharges": false
+}
diff --git a/azure-role-based.example.json b/azure-role-based.example.json
@@ -0,0 +1,17 @@
+{
+  "profile": "role-based-data",
+  "requiredRole": "AppUser",
+  "readinessPath": "/api/AppReady",
+  "subscriptionId": "00000000-0000-0000-0000-000000000000",
+  "tenantId": "00000000-0000-0000-0000-000000000000",
+  "apiClientId": "00000000-0000-0000-0000-000000000000",
+  "sqlAdminObjectId": "00000000-0000-0000-0000-000000000000",
+  "sqlAdminName": "deployment-operator",
+  "resourceGroup": "data-app-dev",
+  "location": "eastus",
+  "environment": "dev",
+  "name": "data-app",
+  "gatewayImage": "yourregistry.azurecr.io/app-gateway:0.1.0",
+  "dabImage": "yourregistry.azurecr.io/app-data:0.1.0",
+  "registryServer": "yourregistry.azurecr.io"
+}
diff --git a/docs/README.md b/docs/README.md
@@ -15,6 +15,7 @@ To try something already implemented, use the [Todo reference app](../examples/t
 ## Command and configuration reference
 
 - [Local runtime](reference/local-development.md): services, workspace settings, diagnostics and recovery.
+- [Role-based-data profile](reference/role-based-data.md): SQL/DAB/browser startup, application-role authorization, matching costs and private SQL Azure deployment.
 - [Copilot plugin](reference/copilot-plugin.md): installation, binding and troubleshooting.
 - [Guide command](reference/guide.md): saved brief and checkpoint format.
 - [Demo cost review](reference/demo-cost.md): offline cost command and SQL billing settings.

diff --git a/docs/guides/build-your-app.md b/docs/guides/build-your-app.md
@@ -33,6 +33,10 @@ Complete [Get started](getting-started.md) before downloading dependencies or la
 
 Your AI assistant can help write your frontend, API and schema; SQL Apps does not generate a complete domain app automatically. Review its changes and use the startup path for your application in [Run locally](run-locally.md). Trying the Todo reference is optional, not a prerequisite.
 
+For substantial new screens or a visual redesign, ask your assistant to use the `sql-apps-frontend-design` skill for an app-appropriate visual direction and browser review of the rendered interface.
+
+Check capability/access support early: the [role-based-data profile](../reference/role-based-data.md) provides SQL/DAB/browser startup with trusted application-role forwarding and a matching paid private-SQL Azure path. Domain screens, procedures and actual workflow acceptance still need implementation. The full foundation retains files/jobs; do not add excluded services or switch to anonymous access just to fit a template.
+
 In the browser, create a test record and reload the page. Check that it is still there. Try a missing required field and, if the app has different users, check who can see or edit the record. Use synthetic data while developing.
 
 ## 3. Make one useful change
@@ -51,7 +55,7 @@ Keep a short description of the agreed app and next change. You can ask your AI
 npm run guide
 ```
 
-This shows saved decisions and a suggested next step. Saved check results are historical; it does not start the app or check that running services are healthy. After a code change, run the affected workflow again. See the [guide command reference](../reference/guide.md) if you want to manage the saved brief yourself.
+This shows saved decisions and a suggested next step. Saved check results are historical; it does not start the app or check that running services are healthy. Record launch evidence under `run-locally`, not `describe`, and update an already completed `nextChange` rather than repeating it. Distinguish completed setup, running services and outstanding browser acceptance. After a code change, run the affected workflow again. See the [guide command reference](../reference/guide.md).
 
 ## 4. Share when it is useful
 

diff --git a/docs/guides/costs.md b/docs/guides/costs.md
@@ -16,7 +16,7 @@ Azure SQL and Container Apps have free allowances, but the current demo template
 
 If zero Azure spending is a requirement, stay local until you have reviewed a hosting design that meets it. SQL Apps does not currently provide a guaranteed zero-cost deployment.
 
-Before creating resources, review the target region, subscription eligibility, fixed charges, expected usage and cleanup plan. The [offline demo cost command](../reference/demo-cost.md) identifies known charges without contacting Azure; it is not a price quote or a spending cap.
+Before creating resources, select the approved capability/access profile, then review the target region, subscription eligibility, fixed charges, expected usage and cleanup plan. The [offline demo cost command](../reference/demo-cost.md) identifies known demo charges without contacting Azure; it is demo-only, not an authenticated app cost model, price quote or spending cap. Role-authorized data-only apps use the matching [role-based-cost review](../reference/role-based-data.md#profile-specific-azure-preparation); do not price an older stack or substitute the full foundation as though it were the agreed app.
 
 ## What happens when an allowance runs out?
 

diff --git a/docs/guides/getting-started.md b/docs/guides/getting-started.md
@@ -77,7 +77,7 @@ The Azure SQL Database container is in **private preview**. [Request access](htt
 
 If a usable image is cached, you do not need to download it again just to refresh it. Startup verifies the actual SQL engine. If preview access is not available yet, keep your completed setup and resume when it is; do not substitute a different database.
 
-SQL startup accepts the container EULA using `ACCEPT_EULA=Y`. Review the preview's terms before starting it.
+Startup passes `ACCEPT_EULA=Y`; there is no chat dialog. Review the [container documentation/access instructions](https://aka.ms/azuresqldb-container) and applicable terms supplied with your preview registry access before approving SQL startup under those terms. If those terms are unavailable, pause rather than assume acceptance. This approval does not cover other licenses or later operations.
 
 ## 5. Choose your next step
 

diff --git a/docs/guides/run-locally.md b/docs/guides/run-locally.md
@@ -6,12 +6,36 @@ Run a browser app backed by SQL on your own computer. No Azure subscription is r
 
 | What you are working on | Startup path |
 | --- | --- |
-| Your own app | Follow [Build your app](build-your-app.md). Use the foundation startup below once its screens and schema are implemented. |
+| Your own data-only app | Follow [Build your app](build-your-app.md) and the data-only steps below; do not start excluded file/job services. |
+| Your own app with files/jobs | Use the foundation startup below after implementing its screens, schema and authorization. |
 | The included Todo reference | Follow the [Todo guide](../../examples/todo/README.md). It starts only SQL, DAB and the browser/API. |
 | The foundation's file-processing demonstration | Use the startup below. It also starts local storage and Functions. |
 
 The foundation is not a finished inventory or registration app. Its default browser demonstrates files and jobs; your domain screens need to be implemented.
 
+## Approvals and readiness
+
+Before the first approval, explain the remaining stages: needed tool installations, dependency restore, build, workspace initialization, container downloads/builds, SQL terms/schema/startup, then synthetic acceptance writes. Approve only the named operations and target; approving `npm ci` does not approve build, and workspace initialization does not approve launch. Previously approved operations need not be approved again unless their scope changes.
+
+If the approval control first returns "user unavailable" or is invisible, no approval was captured. Stop retrying that control. The assistant should provide one precise statement with the actual checkout, operations, effects and exclusions that you can send in ordinary chat. Wait for explicit consent before continuing.
+
+Startup passes `ACCEPT_EULA=Y`; there is no chat dialog. Review the [container documentation/access instructions](https://aka.ms/azuresqldb-container) and applicable preview terms supplied with your registry access. Explicitly approving SQL startup under those terms permits the launcher to pass that value; it is not approval for other licenses.
+
+Report **implemented**, **built**, **running** and **workflow verified** separately. A proposed port/URL is unavailable until the intended server responds and readiness checks pass. Only then open/publish the launch URL. Verify the agreed browser save/reload action and SQL persistence separately; tests or a successful build do not replace it. If launch is blocked, the task is blocked, not complete.
+
+## Run a data-only domain app
+
+For a role-authorized domain app, use the [role-based-data profile](../reference/role-based-data.md): configure its dedicated application role and read-only readiness procedure, then use `npm run local -- role-based-app` after scoped build/workspace/startup approval. It starts SQL/DAB/browser only and explicitly labels authorized/unauthorized user simulations; `role-based-serve` resumes it. Real Entra sign-in is used in Azure, not local simulation.
+
+For advanced SQL-only work without this role-based profile, the existing individual steps remain available, with the scoped approvals above:
+
+1. Restore/build as needed and select the workspace using `workspace-plan` and approved `workspace-init`.
+2. Use `npm run local -- start-sql`, or `verify <selected-container>` for explicitly approved reuse.
+3. Use `npm run local -- init` and `npm run local -- data`.
+4. Start the gateway with `npm run local -- serve-sql`.
+
+Pass the same optional SQL container name throughout when selecting a non-default container. `serve-sql` omits file/job adapters but does not generate domain screens, custom application roles or app-specific readiness checks. Remove excluded controls and verify the application's actual browser action, authorization and SQL save/reload. Do not run `app`, `services` or file-processing acceptance for this scope. The selected synthetic reference is not a role-authorized substitute.
+
 ## Start the foundation
 
 From the project folder:
@@ -31,7 +55,7 @@ npm run local -- app
 
 Workspace selection keeps this checkout's service names, ports and saved state separate. Startup downloads missing images, accepts the SQL container EULA, publishes the project schema and launches services. Read the [local runtime reference](../reference/local-development.md) before reusing an existing stack or database.
 
-Open the browser URL printed in the terminal. For the foundation demonstration, choose Development Alice, upload a small text file and select **Process file**. The completed job shows byte count and SHA-256. Development Bob has a separate view of files and jobs.
+After the intended server responds and `/health/ready` passes, open its reported browser URL. For the approved foundation file/job demonstration, choose Development Alice, upload a small text file and select **Process file**. The completed job shows byte count and SHA-256. Development Bob has a separate view of files and jobs.
 
 These local identities are simulations, not production sign-in. Keep the local app and DAB on loopback; do not expose them to other computers.
 
@@ -53,7 +77,7 @@ To stop the foundation worker and storage without deleting their data:
 npm run local -- stop-services
 ```
 
-After stopping services, use `app` to start them again. Selected-reference commands have their own stop/resume steps in the Todo guide. Do not delete volumes or saved credentials to restart an app.
+After stopping foundation services, use `app` to start them again. Data-only apps resume with `serve-sql` against running SQL/DAB, not `serve` or `app`. Selected-reference commands have their own stop/resume steps in the Todo guide. Do not delete volumes or saved credentials to restart an app.
 
 ## When something fails
 

diff --git a/docs/guides/sharing.md b/docs/guides/sharing.md
@@ -8,26 +8,31 @@ Before moving a local app online, decide **who should use it** and **what inform
 | --- | --- |
 | Keep using the app on your computer | Stay local. No cloud deployment is needed. |
 | Let people try a public app with synthetic data | The minimal public-demo workflow is still in development. Local reference testing, image assembly, diagnostics and templates exist, but there is no completed guided deployment command. |
-| Share an authenticated app with real users | The full Azure deployment commands are available. They require Entra setup, paid infrastructure and a privately connected SQL deployment runner. |
+| Share an authenticated app with the full foundation capabilities | Full Azure commands require Entra setup, paid Functions/storage/Key Vault/private-network infrastructure and a privately connected SQL deployment runner. |
+| Share a role-authorized data-only domain app | Use the [role-based-data profile](../reference/role-based-data.md): matching cost review, two-image artifacts, authorized identity/assignment and private SQL deployment. Paid infrastructure and live authorization/browser acceptance are still required. |
 
 Do not put real or sensitive information in the anonymous synthetic-data reference.
 
 ## Review costs first
 
-Read [Costs and growth](costs.md). The goal is free-tier-first, but the current templates include recurring charges. A cost review is a decision step, not permission to spend or deploy.
+Select the agreed capability/access profile before choosing a cost command. Read [Costs and growth](costs.md). The goal is free-tier-first, but current templates include recurring charges. A cost review is a decision step, not permission to spend or deploy.
 
 For a public-demo cost review after building:
 
 ```powershell
 npm run azure -- demo-cost azure-demo-cost.example.json
 ```
 
-The zero-spend example reports known fixed-charge blockers and exits 2. This is expected; it does not create resources. See the [cost command reference](../reference/demo-cost.md) to interpret its output.
+The zero-spend example reports known fixed-charge blockers and exits 2. This is expected; it does not create resources. Its output is demo-only, not a price estimate for an authenticated app. Review the authenticated application's actual resources/prices separately; missing estimates are unknown, not zero. See the [cost command reference](../reference/demo-cost.md).
 
 ## Prepare an authenticated deployment
 
 If this is the path you need, follow the [deployment reference](../reference/deployment.md). You will review your Azure target, identities, images, networking, schema and costs before creating resources.
 
-After deployment, test sign-in, each user's access, saved data, file behavior and recovery in that environment. Local tests and template compilation do not prove those cloud behaviors.
+If the approved app excludes files/jobs, select `role-based-data` rather than expanding to the full template or changing authorized access to an anonymous demo. Its `identity` command creates the configured human role and `role-based-assign` manages explicitly approved assignments; the foundation profile still creates `Function.Invoke`. Verify token claims and trusted DAB forwarding in the real environment.
+
+Existing-resource discovery must not change the deployment subject. Older matching Azure resources are potential collisions and remain untouched. Keep the new checkout and its artifacts as the source unless reuse is explicitly requested and separately reviewed. Preparation is not permission to create, modify or delete resources.
+
+After an approved deployment, test sign-in, each user's access, saved data, selected capabilities and recovery in that environment. Local tests and template compilation do not prove those cloud behaviors.
 
 For the evolving minimal public-demo path, use [public-demo preparation](../reference/demo-deployment.md). It is a technical reference, not a shortcut around the incomplete deployment workflow.