[lweberru]

Application access profiles previously offered only the 144 default workload permissions, so a Platform Owner could remove rights but could not add Kubernetes or other project services. The editor now offers the complete official project catalogue (916 permissions checked on 2026-10-27), grouped and searchable by service, identifier and description. The 144-right defaults stay unchanged; requester and Application-service-account selections remain separate.

The backend independently checks new publication profiles against the reviewed snapshot or an authenticated live catalogue. The Assistant can add a named service’s rights to existing granular profiles, preserving existing rights and the central owner, targeting both identities or an explicitly selected identity. All proposal paths reject invented permissions. Existing published versions, orders and State bindings are unchanged; acceptance still requires saving and a new publication. Recovery role inventory supports the same permission bounds.

Validation:

• Local complete check: 1269 passed, 76 existing gated skips; follow-up Assistant checks: 167 passed.
• Isolated database: 71 passed. Browser suite: 380 passed, followed by all 26 affected desktop/mobile cases after final UI wording changes.
• Independent review completed; generic proposal catalogue validation and recovery bound findings addressed.
• Real-model topic qualification runs twice. Earlier receipts exposed a serving grammar incompatibility, IPv4 topic routing and missing capacity caveat; these are corrected without weakening the factual oracles. Final affected-topic qualification passed all 24 cases (12 cases × 2 independent repetitions), knowledge SHA256 d58a93b40fb96fc191af7865283bca669ed7b1fa328b9590674550e8ad07384e. Merged-source qualified release 40567962446 passed all 138 repeated full-suite cases and the 13-turn continuous journey against the real model; both receipts bind the same knowledge SHA256. The qualified Dev release completed successfully with runner_pool_size=1 and Assistant enabled. Independent runtime verification confirmed matching App/Runner source, one live ready pool slot, protected routes, unchanged existing recovery/publication evidence, and removal of the temporary route-free read-only diagnostic app.

Project IAM permissions for Kubernetes are distinct from in-cluster RBAC. No customer Plan/Apply, State repair or production deployment is part of this change. English/German user and contributor guidance is included.

Hosted UI acceptance on the deployed source passed in a fresh guest browser with all non-GET/HEAD requests blocked: 916 selectable project permissions, 144 initial selections per identity, 11 SKE rights added only to the requester (155), Application-service-account selection preserved (144), IAM rights selectable but initially unchecked. Existing single-template-editor navigation and unsaved local draft preservation also passed. No customer Plan/Apply or remote State/lock write was performed.