Read permission is not export permission

Granting read on a record does not mean bulk export is allowed.

Export (CSV download, dump endpoint, "download all") has a different blast radius: more rows, richer fields, and a durable file that leaves your UI. Treat it as its own action in authorization, with its own audit event and tighter rate limits.

A common leak: the list UI checks read, then the export handler reuses that check and streams every matching row. Authorize export (or read + an explicit export capability) at the handler that produces the file, not only at the screen that showed the table.

If a role may view a few rows but must not vacuum the tenant, say so in the policy — don't hope the UI never offers the button.