Sub-ticket of PLUTO-670 Non-owner app role for archive/fraud/audit table write containment (real remedy, migration 100 is hygiene-only) · pluto