DL-495

Config layers default → tenant → user → role, resolved on the Server; the user is agent_accounts.owner_user_id, and the role layer, keyed (tenant, owner, agent_accounts.role), applies only to an agent with a non-empty role.

Status: Active (Matt, 2026-10-13)