==============================================================================
  PROD — viewer-prod (read-only)
==============================================================================
  ✓  can-i get      pods                      → yes
  ✓  can-i list     services                  → yes
  ✓  can-i get      namespaces                → yes
  ✗  can-i delete   pods                      → no
  ✗  can-i create   secrets                   → no
  ✗  can-i get      secrets                   → no
  ✗  can-i create   pods/exec                 → no
  ✗  can-i update   deployments               → no
  ✗  can-i delete   persistentvolumeclaims    → no

==============================================================================
  PROD — deployer-prod (CI/CD, default ns ONLY)
==============================================================================
  ✓  can-i update   deployments               -n default      → yes
  ✓  can-i patch    deployments               -n default      → yes
  ✓  can-i get      pods                      -n default      → yes
  ✗  can-i create   deployments               -n default      → no
  ✗  can-i create   namespaces                (cluster)       → no
  ✗  can-i get      secrets                   -n default      → no
  ✗  can-i create   pods/exec                 -n default      → no
  ✗  can-i delete   persistentvolumeclaims    -n default      → no
  ✗  can-i update   deployments               -n rbac-sod     → no

==============================================================================
  PROD — admin-prod (full cluster-admin)
==============================================================================
  ✓  can-i "*"      "*"                       → yes
  ✓  can-i delete   pods                      → yes
  ✓  can-i create   namespaces                → yes
  ✓  can-i create   secrets                   → yes
  ✓  can-i create   clusterrolebindings       → yes

==============================================================================
  STAGING — developer-staging (full edit en staging)
==============================================================================
  ✓  can-i create   deployments               → yes
  ✓  can-i delete   pods                      → yes
  ✓  can-i create   namespaces                → yes
  ✗  can-i create   clusterrolebindings       → no
  ✓  can-i get      secrets                   → yes

==============================================================================
  CRITICAL — developer-staging token contra PROD CLUSTER (cross-env)
==============================================================================
  ✓  can-i get      pods                      → error: You must be logged in to the server (Unauth
  ✓  can-i list     namespaces                → error: You must be logged in to the server (Unauth
  ✓  can-i create   deployments               → error: You must be logged in to the server (Unauth
