# CRM Integration — Permission-Code Convention

CRM is a registered SIMS `Application` (code `CRM`, seeded via
`src/utils/seed.py::STANDARD_APPLICATIONS`, mirrored in
`scripts/reseed_rbac.sql`). See [`crm_example.py`](crm_example.py) for a
minimal login → verify-JWT → authorize walkthrough.

This document only fixes the naming convention every CRM permission must
follow. It does not create CRM's permission list — that is scoped to a
separate story, since CRM's actual modules (leads, customers, users, ...)
aren't finalized yet.

## Convention

```
crm.<module>.<action>
```

- **`<module>`** — the CRM resource the permission governs (e.g. `leads`,
  `customers`, `users`). Maps 1:1 to CRM's own `resource` values, mirroring
  how ODD-IT's permissions are grouped under `audit`, `template`, `org`, etc.
  in `STANDARD_APPLICATIONS`.
- **`<action>`** — one of the standard actions already used across every
  other application's taxonomy: `create`, `view`, `update`, `delete`,
  `manage`. Don't invent a new verb if one of these already fits.

Examples: `crm.leads.create`, `crm.leads.view`, `crm.customers.update`,
`crm.users.delete`.

## Why this shape

It matches the `<module>.<action>` pattern SIMS, LMS, IMS, and ODD-IT
already use in `APP_PERMISSIONS` (`src/utils/seed.py`) — prefixing with
`crm.` keeps CRM's permission codes globally unique across applications
while staying consistent with the rest of the platform's taxonomy, so a
generic `role.view`/`role.manage` UI can list and group permissions by
application without any CRM-specific logic.