# Templates Administrator Guide

## Permissions

- `templates:template:read` reads definitions and evidence.
- `templates:template:write` creates immutable revisions.
- `templates:template:publish` selects the revision allowed for final output.
- `templates:template:render` validates and renders supplied snapshots.
- `templates:template:admin` manages every visible tenant/group/user definition.

The managed `template_manager` role contains read, write, publish, and render.

## Scope And Publication

Definitions can be tenant-, group-, or user-scoped. Non-administrators may only
write their own user templates and templates belonging to one of their groups.
Published output remains pinned even when a later draft revision is created.

## Output Storage

Files is optional. When `files.artifact_store` is present and the actor has
`files:file:upload`, managed output is written below `Generated/Templates` with
template, input, and output hashes. Otherwise Templates stores a bounded
database payload. Review database and Files retention together before deleting
render evidence.

## Operations

Apply the module Alembic migration before startup. Monitor rejected renders for
contract drift, output limits, missing Files permission, and reused idempotency
keys. HTML is designed for browser/OS printing; do not treat it as a signed PDF
or proof of physical printer delivery.