docs: refresh permission key form and drop removed app.admin.users config

[rohilsurana]

What

Refresh the docs that fell behind recent changes to permissions and the boot config. Two themes, one commit each.

Permission key form and reconcile kinds

• authz/permission.mdx: the "Custom Permissions" section taught the old name + namespace create model, which is no longer accepted. Rewrote it around the key (service.resource.verb), replaced the name/namespace sample table with a key table, swapped the link to the removed resource-config testdata for a kind: Permission desired-state example, and reframed the slug note (dots become underscores).
• authz/policy.mdx: removed the description of the boot-time custom-permission loader and its config.yaml rule-set link. Custom permissions are now created through reconcile or the admin API.
• reference/cli.mdx: the export and reconcile "supported kinds" lists showed only 5 kinds. Added MetaSchema, BillingProduct, and BillingPlan, and noted that a billing product or plan cannot be deleted through the API. This now matches the CLI help in cmd/reconcile.go.
• rfcs/0001-declarative-reconcile.md: the summary sentence listed 5 kinds; added the other three. Added MetaSchema to the value node in the diagram. Removed "Billing plans as a kind" from Future work since it shipped.

Removed app.admin.users config

The server no longer reads app.admin.users (superuser promotion from a config list is gone; the bootstrap service account replaced it). Updated the sample config and the config reference to use admin.bootstrap (client_id / client_secret) instead:

• configurations.mdx and reference/configurations.mdx: replaced the admin.users block with the admin.bootstrap block, updated the config-reference table row, and dropped a stale "resource config cache refreshed" line from the sample startup log.
• basics.mdx: same block replacement, and the field summary line.

Docs only. No code change.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 1aa61e76-5a41-4e5f-98e6-46da044f0d31

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
frontier	Ready	Preview	Aug 21, 2026 7:00am

[coveralls]

Coverage Report for CI Build 32456746092

Coverage remained the same at 48.804%

Details

• Coverage remained the same as the base build.
• Patch coverage: No coverable lines changed in this PR.
• No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	40101
Covered Lines:	19571
Line Coverage:	48.8%
Coverage Strength:	15.73 hits per line

---

💛 - Coveralls