diff --git a/CLAUDE.md b/CLAUDE.md
index 704a2f37b..fc1a51942 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -184,6 +184,7 @@ npm run screenshots:smoke   # gating interaction tests (search, Orbit, nav)
 | `src/types/image-sequence-constants.ts` | Constants shared by the publisher API (`functions/`), the GHA runner (`cli/`), and the portal (`src/`) for the image-sequence upload pipeline |
 | `src/types/zyra-workflow-constants.ts` | Constants shared by the publisher API (`functions/`), the GHA runner (`cli/`), and the portal (`src/`) for the Zyra workflow pipeline — stage/command allowlist, template fields, run statuses (`docs/ZYRA_INTEGRATION_PLAN.md`) |
 | `src/types/node-features.ts` | Per-node feature-toggle constants shared by the publisher API (`functions/`) and the portal + public SPA — `FEATURE_KEYS` / `FeatureMap`, all-on defaults, fail-open normalization (missing/unknown keys resolve to enabled) |
+| `src/types/publisher-roles.ts` | Publisher role → capability matrix shared by the publisher API (`functions/`) and the portal — `CAPABILITIES` / `ROLES` / `ROLE_CAPABILITIES`, `roleCan` / `capabilitiesForRole`, legacy-string `normalizeRole` (fail-closed to `reviewer`). The single source of truth for authorization (`docs/PUBLISHER_ROLES_PLAN.md`) |
 | `src/data/regions.ts` | Common region bounding boxes for name-based region resolution |
 | `src/services/orbitCharacter/index.ts` | `OrbitController` — public API for the Orbit character (owns the Three.js scene, rAF loop, state machine) |
 | `src/services/orbitCharacter/orbitScene.ts` | Three.js scene + per-frame update for the Orbit character |
@@ -243,14 +244,14 @@ npm run screenshots:smoke   # gating interaction tests (search, Orbit, nav)
 | `src/ui/publisher/pages/workflows.ts` | `/publish/workflows` — Zyra workflow list |
 | `src/ui/publisher/pages/workflow-detail.ts` | `/publish/workflows/:id` — workflow summary + run history + Run now |
 | `src/ui/publisher/pages/workflow-edit.ts` | `/publish/workflows/new` + `…/:id/edit` — workflow form (YAML→JSON client-side, server-side Validate) |
-| `src/ui/publisher/pages/featured-hero.ts` | `/publish/featured-hero` — set the "Right now" hero override (`docs/HERO_ADMIN_SCOPING.md`) |
+| `src/ui/publisher/pages/featured-hero.ts` | `/publish/featured-hero` — set the "Right now" hero override (`hero.manage`: editors / admins); callers without it get a read-only view of the current pin (`docs/HERO_ADMIN_SCOPING.md`) |
 | `src/ui/publisher/pages/node-profile.ts` | `/publish/node-profile` — edit the node / host-organization profile (org name, mission, about, region focus, tone, links) — the "about the host" context Phase 3d AI drafts ground themselves in |
 | `src/ui/publisher/pages/blog.ts` | `/publish/blog` — blog authoring list (drafts + published, status badges, New post) |
 | `src/ui/publisher/pages/blog-edit.ts` | `/publish/blog/new` + `…/:id/edit` — tabbed blog editor (Content / Sources / Media / AI draft): dataset/event grounding pickers, the **Media** tab (reuses the Events-tab `media-suggest` engine — Worldview / Commons / ShakeMap / NHC / agency YouTube + the cited event's story image — to insert imagery into the body or set the post's cover image), the AI Generate panel (tone/length/companion-tour → `POST /publish/blog/generate`), markdown body with the shared toolbar + sanitized Preview, Save/Publish/Unpublish |
 | `src/ui/publisher/pages/feeds.ts` | `/publish/feeds` — the current-events feed console: registered connectors (pause/resume/remove, Run now, last-run status), the curated preset gallery, and the bring-your-own RSS/Atom form (`docs/CURRENT_EVENTS_PLAN.md` §9) |
 | `src/ui/publisher/pages/events.ts` | `/publish/events` — current-events review queue: curator approve/reject of proposed events + their dataset links (`docs/CURRENT_EVENTS_PLAN.md` §5) |
-| `src/ui/publisher/pages/analytics.ts` | `/publish/analytics` — privileged analytics dashboard over the D1 rollups, incl. the MapLibre spatial-attention heatmap (Phase B of `docs/ANALYTICS_STORAGE_AND_ADMIN_PLAN.md`) |
-| `src/ui/publisher/pages/feedback.ts` | `/publish/feedback` — privileged feedback review (AI thumbs + bug/feature reports) over the D1 feedback tables; replaces the feedback-admin HTML dashboard (Phase C of `docs/ANALYTICS_STORAGE_AND_ADMIN_PLAN.md`) |
+| `src/ui/publisher/pages/analytics.ts` | `/publish/analytics` — read-only analytics dashboard over the D1 rollups (open to any active publisher), incl. the MapLibre spatial-attention heatmap (Phase B of `docs/ANALYTICS_STORAGE_AND_ADMIN_PLAN.md`) |
+| `src/ui/publisher/pages/feedback.ts` | `/publish/feedback` — read-only feedback review (AI thumbs + bug/feature reports; open to any active publisher) over the D1 feedback tables; replaces the feedback-admin HTML dashboard (Phase C of `docs/ANALYTICS_STORAGE_AND_ADMIN_PLAN.md`) |
 | `src/ui/publisher/pages/me.ts` | `/publish/me` — current-user identity + role display |
 | `src/ui/publisher/pages/users.ts` | `/publish/users` — admin-only Users tab: approve / reject / suspend / reactivate publishers and change roles (admin / publisher / readonly) |
 | `src/ui/tourAuthoring/index.ts` | Tour-authoring public surface — detects `?tourEdit=` and mounts the dock |
diff --git a/docs/BACKEND_MODULES.md b/docs/BACKEND_MODULES.md
index f35dd5800..1e5c1d9dc 100644
--- a/docs/BACKEND_MODULES.md
+++ b/docs/BACKEND_MODULES.md
@@ -213,6 +213,7 @@ design rationale in the `docs/CATALOG_*` plan docs.
 | `functions/api/v1/_lib/preview-token.ts` | Short-lived signed preview tokens for unpublished datasets and tours |
 | `functions/api/v1/_lib/publisher-mutations.ts` | Admin user-administration store helper — list / get / update publishers, self-lockout + last-admin guardrails |
 | `functions/api/v1/_lib/publisher-store.ts` | D1 reader / writer for the `publishers` table |
+| `functions/api/v1/_lib/capabilities.ts` | Server-side capability check (`can` / `canOwnOrAny`) — thin adapter over the shared role→capability matrix (`src/types/publisher-roles.ts`); the authorization primitive routes/mutations gate on (`docs/PUBLISHER_ROLES_PLAN.md`) |
 | `functions/api/v1/_lib/r2-public-url.ts` | Build a publicly-readable URL for an R2 object key |
 | `functions/api/v1/_lib/image-upload.ts` | Shared validation for small direct image uploads (base64-in-JSON): png/jpeg/webp allowlist, magic-byte check against the claimed type, bounded decode, sha256 for content-addressed keys — used by the node-profile logo and tour-media routes |
 | `functions/api/v1/_lib/r2-store.ts` | R2 storage helpers — Phase 1b |
diff --git a/docs/CATALOG_PUBLISHING_TOOLS.md b/docs/CATALOG_PUBLISHING_TOOLS.md
index b192ca6f7..98a9786b8 100644
--- a/docs/CATALOG_PUBLISHING_TOOLS.md
+++ b/docs/CATALOG_PUBLISHING_TOOLS.md
@@ -704,11 +704,16 @@ Phase 3 ships a two-tier human role model behind Cloudflare Access:
 
 - Cloudflare Access protects `/publish/**` and `/api/v1/publish/**`.
 - On first login, the API handler reads the Access JWT and finds an
-  existing `publishers` row by email or JIT-provisions one. A login
-  from a `TRUSTED_PUBLISHER_DOMAINS` domain (or dev-bypass) provisions
-  as `role='admin', status='active'`; any other user login provisions
-  as `role='publisher', status='pending'`; service tokens as
-  `role='service', status='active'`.
+  existing `publishers` row by email or JIT-provisions one. Defaults are
+  least-privilege: a login from a `TRUSTED_PUBLISHER_DOMAINS` domain
+  provisions as `role='reviewer', status='active'` (auto-approved,
+  read-only); any other user login as `role='reviewer',
+  status='pending'`; service tokens as `role='service',
+  status='active'`; dev-bypass as `role='admin', status='active'`. The
+  one exception is the bootstrap: the first human on a deploy with **no
+  active admin** is provisioned `role='admin', status='active'` (service
+  tokens excepted) so there is always an operator to approve/promote the
+  rest.
 - `affiliation` defaults to the deploying organisation's name (a
   Wrangler env var) and is editable in the portal's profile page.
 - **Admins** have full administrative authority over the deploying
diff --git a/docs/PUBLISHER_ROLES_PLAN.md b/docs/PUBLISHER_ROLES_PLAN.md
new file mode 100644
index 000000000..017e15c61
--- /dev/null
+++ b/docs/PUBLISHER_ROLES_PLAN.md
@@ -0,0 +1,395 @@
+# Publisher roles & capabilities — scoping
+
+**Status:** implemented (R1–R5 landed); this doc is now the reference
+for the model. All five open decisions were resolved as recommended
+(D1 tighter events approval, D2 rename, D3 editor hero, D4 contributor
+default, D5 plain drafts).
+**Last reviewed:** 2026-07-15
+**Owner:** catalog / publisher-portal track
+**Supersedes when:** the role/capability matrix is folded into
+`CATALOG_PUBLISHING_TOOLS.md` (the `publisher-store.ts` taxonomy comment
+already points here).
+
+> **Implementation note.** The matrix lives in
+> `src/types/publisher-roles.ts` (shared) with the server adapter in
+> `functions/api/v1/_lib/capabilities.ts`. `isPrivileged` / `isAdmin`
+> are retained as thin aliases (`operator.manage` / `users.manage`).
+> Every create surface now gates in the UI on `content.create`:
+> events / hero / users as originally specified, plus datasets / blog /
+> tours / import, which hide (or, for import, replace with a restricted
+> card) their create affordance after a `/me` probe. The datasets probe
+> runs on a dedicated `meFetchFn` seam so it doesn't perturb the
+> list's fetch-sequence tests. The server 403 remains the authoritative
+> gate behind every one of these.
+
+A design for a WordPress-style five-role model for the publisher
+portal, replacing today's effectively-binary (`admin` vs everyone)
+authorization with an explicit **capability matrix**.
+
+This is a scoping artifact, not an implementation. It lays out the
+problem, the capability vocabulary, the role→capability matrix, the
+per-endpoint mapping, the data model + migration, the portal UI, the
+phasing, and the open decisions.
+
+---
+
+## 1. Why
+
+The recent "read-all / write-own" work (PR #283) opened datasets,
+events, and blog to any active publisher while keeping *writes*
+owner-scoped. That's the right shape, but it exposed a structural gap:
+
+- **Authorization is binary.** The only two primitives in the codebase
+  are `isPrivileged(p)` (`role ∈ {admin, service}`) and `isAdmin(p)`
+  (`role === 'admin'`). Every gate is one of those two plus an
+  ownership check.
+- **`readonly` is a no-op.** `ASSIGNABLE_ROLES` advertises
+  `['admin', 'publisher', 'readonly']`, but `readonly` is **never
+  checked anywhere**. A `readonly` account can create and write its own
+  datasets/blog/events exactly like a `publisher`. We ship a role that
+  does nothing.
+- **Nothing sits between author and admin.** The only way to let
+  someone review/publish *other people's* content is to hand them full
+  admin — which also grants user management, feed connectors, the node
+  profile, and the signing keys. That's too much power for a "managing
+  editor."
+
+WordPress solved this decades ago with a small, legible ladder:
+Administrator ▸ Editor ▸ Author ▸ Contributor ▸ Subscriber. Each rung
+is a well-understood bundle of capabilities. We adopt the same ladder,
+implemented as a capability matrix so the policy lives in one table.
+
+### Non-goals
+
+- **Per-object ACLs / sharing.** No "share this dataset with user X."
+  Access is role + ownership, not per-row grants.
+- **Groups / teams beyond `org_id`.** The `publishers.org_id` column
+  exists and may later scope visibility to an org, but this plan is
+  about *role* capabilities, not org membership.
+- **Federation role propagation.** Roles are node-local. A peer node's
+  roles are its own; nothing here crosses the federation boundary.
+- **A general CMS permission engine.** Fixed capability enum, fixed
+  role table. No user-defined roles or runtime capability editing.
+
+---
+
+## 2. The five roles
+
+| Role | WordPress analogue | One-line charter |
+|---|---|---|
+| **Admin** | Administrator | Everything — content, users, feeds, node profile, keys. |
+| **Editor** | Editor | Review/publish/edit **any** content; **no** users/operator settings. |
+| **Author** | Author | Create + publish/edit **own** content. |
+| **Contributor** | Contributor | Create + edit **own drafts**; **cannot self-publish** — an Editor/Admin approves. |
+| **Reviewer** | Subscriber | **Read-only** — sees catalog, queues, insights; authors nothing. |
+
+Plus one non-assignable machine role:
+
+- **Service** — machine credential / CLI token. Capability-equivalent
+  to Admin. Provisioned automatically from an Access service token,
+  never hand-assigned (unchanged from today).
+
+### Naming (Decision D2, §8)
+
+Today's stored role strings are `admin` / `publisher` / `readonly` /
+`service`. This plan proposes canonical strings
+`admin` / `editor` / `author` / `contributor` / `reviewer` / `service`,
+migrating `publisher → author` and `readonly → reviewer` (additive
+backfill, same pattern as `0023_publisher_roles_two_tier.sql` which
+renamed `staff/community → admin/publisher`). Display labels are i18n
+keys, so the wire string and the shown label are already decoupled.
+
+---
+
+## 3. Capability vocabulary
+
+A capability is a verb the server checks, independent of role. The
+matrix maps roles to capability sets; gates ask `can(publisher, cap)`,
+never `role === '...'`.
+
+| Capability | Meaning |
+|---|---|
+| `content.read` | Read the catalog, the events queue, the blog list, and any single row/draft. |
+| `content.create` | Create a new **own** draft (dataset / event / blog / tour). |
+| `content.edit.own` | Edit/delete a row you own. |
+| `content.publish.own` | Publish/retract (blog, dataset) or **approve** (event) a row you own. |
+| `content.edit.any` | Edit/delete **any** row, regardless of owner. |
+| `content.publish.any` | Publish/retract/approve/reject **any** row, incl. claiming an unclaimed event. |
+| `insights.read` | Read Analytics + Feedback dashboards. |
+| `hero.read` | See the current "Right now" hero pin. |
+| `hero.manage` | Set/clear the hero override. |
+| `operator.manage` | Feed connectors, node profile, R2/key config, feed Refresh. |
+| `users.manage` | Approve/suspend publishers, assign roles (the Users tab). |
+
+Ownership-aware gates compose a capability with an ownership test, e.g.
+
+```
+canEditDataset(p, row) =
+  can(p, 'content.edit.any') ||
+  (can(p, 'content.edit.own') && row.publisher_id === p.id)
+```
+
+This is the same shape as today's `canMutateDataset` /
+`canMutateBlogPost` / `canMutateEvent`, but the privileged half becomes
+a capability check instead of `isPrivileged`.
+
+---
+
+## 4. Role → capability matrix
+
+`●` = granted, `–` = denied.
+
+| Capability | Reviewer | Contributor | Author | Editor | Admin |
+|---|:--:|:--:|:--:|:--:|:--:|
+| `content.read` | ● | ● | ● | ● | ● |
+| `insights.read` | ● | ● | ● | ● | ● |
+| `hero.read` | ● | ● | ● | ● | ● |
+| `content.create` | – | ● | ● | ● | ● |
+| `content.edit.own` | – | ● | ● | ● | ● |
+| `content.publish.own` | – | – | ● | ● | ● |
+| `content.edit.any` | – | – | – | ● | ● |
+| `content.publish.any` | – | – | – | ● | ● |
+| `hero.manage` | – | – | – | ●¹ | ● |
+| `operator.manage` | – | – | – | – | ● |
+| `users.manage` | – | – | – | – | ● |
+
+¹ `hero.manage` for Editor is **Decision D3** (§8) — the current
+behavior is admin-only. Recommendation: grant it to Editor (the hero is
+an editorial curation call), but it is the one cell reasonable people
+will disagree on.
+
+Service = Admin's column.
+
+**Reading the ladder:** each role is a strict superset of the one to
+its left, except that Editor gains the `*.any` tier and Admin adds the
+operator/users tier on top. That monotonicity is worth preserving —
+it's what makes the model legible.
+
+---
+
+## 5. Per-endpoint mapping
+
+The gate each route should call after Phase R1. "own-or-any" means the
+ownership-composed check from §3.
+
+### Datasets (`functions/api/v1/publish/datasets*`)
+| Route | Today | New gate |
+|---|---|---|
+| `GET` list / `GET :id` | open to active | `content.read` |
+| `POST` (create draft) | open to active | `content.create` |
+| `PUT :id` (edit) | owner-or-privileged | edit own-or-any |
+| `POST :id/publish`, `/retract` | owner-or-privileged | publish own-or-any |
+| `DELETE :id` | owner-or-privileged | delete own-or-any |
+| `POST :id/preview` | owner-or-privileged | edit own-or-any |
+| `POST :id/reindex` | `isPrivileged` | `content.publish.any` |
+
+### Events (`functions/api/v1/publish/events*`)
+| Route | Today | New gate |
+|---|---|---|
+| `GET` list | open to active | `content.read` |
+| `POST` (manual create) | open to active | `content.create` (creator owns) |
+| `POST :id` (review/approve/reject) | unclaimed-or-owner-or-priv | **see D1** |
+| `POST :id/image`, `/tour` | unclaimed-or-owner-or-priv | edit own-or-any |
+| `POST refresh` (feeds) | `isPrivileged` | `operator.manage` |
+
+### Blog (`functions/api/v1/publish/blog*`)
+| Route | Today | New gate |
+|---|---|---|
+| `GET` list / `GET :id` | open to active | `content.read` |
+| `POST` (create), `/generate` | open to active | `content.create` |
+| `PUT :id` (edit) | author-or-priv | edit own-or-any |
+| `POST :id` (publish/unpublish) | author-or-priv | publish own-or-any |
+
+### Tours (`functions/api/v1/publish/tours*`)
+Same shape as datasets (create/edit/publish own-or-any). Tours were not
+part of PR #283's read-all work; folding them into the capability model
+is part of Phase R3/R4.
+
+### Everything else
+| Surface | New gate |
+|---|---|
+| Analytics, Feedback (GET) | `insights.read` |
+| Featured Hero (GET / PUT-DELETE) | `hero.read` / `hero.manage` |
+| Feeds console, Node profile, key/R2 config | `operator.manage` |
+| Users tab | `users.manage` |
+
+---
+
+## 6. The events-approval reconciliation (Decision D1)
+
+This is the one place the five-role model **changes behavior we just
+shipped**, so it gets its own section.
+
+PR #283 decided: *any active publisher may approve an unclaimed
+(feed-proposed) event, thereby claiming ownership.* Under a role ladder
+where **publishing is a privilege that grows with rank**, that's too
+generous — approving an event makes it public, and "make content you
+don't own public" is exactly `content.publish.any` (Editor+).
+
+Recommended reconciliation:
+
+- **Contributor** — may `POST` a manual event (it's a draft/proposed
+  row they own) but **cannot approve** anything, including their own.
+- **Author** — may approve/reject an event **they own** (their manual
+  event) via `content.publish.own`. May **not** approve an unclaimed
+  feed event (that needs `.any`).
+- **Editor / Admin** — may approve/reject **any** event via
+  `content.publish.any`, which is also what claims an unclaimed feed
+  event. Approving still stamps `owner_id` (the claim), so the audit
+  trail of "who made it public" is preserved.
+
+Net effect: the feed review queue becomes an **Editor** responsibility
+(matches "the managing editor runs the newsroom"), while Authors and
+Contributors propose. This is a one-line change to `canMutateEvent`
+plus the approve-branch in the review handler, and an update to the
+events route tests added in PR #283.
+
+> If the team prefers the shipped egalitarian-queue behavior (any
+> author can claim + approve a feed event), that's the alternative for
+> D1 — grant `content.publish.any` on unclaimed-owner rows to Author.
+> The doc recommends the tighter reading for ladder consistency.
+
+---
+
+## 7. Implementation shape
+
+### 7.1 Capability layer (server)
+
+A new pure module `functions/api/v1/_lib/capabilities.ts`:
+
+```ts
+export type Capability = 'content.read' | 'content.create' | …
+export const ROLE_CAPABILITIES: Record<Role, ReadonlySet<Capability>> = { … }
+export function can(publisher: PublisherRow, cap: Capability): boolean
+```
+
+- `isPrivileged` / `isAdmin` become thin, deprecated aliases
+  (`can(p, 'content.publish.any')` / `can(p, 'users.manage')`) so
+  Phase R1 is a **no-behavior-change** refactor with the existing tests
+  still green.
+- The matrix is unit-tested as a table (role × capability), so a
+  future edit to one cell is a visible, reviewed diff.
+
+### 7.2 Shared role→capability constant (both tiers)
+
+The portal needs to gate controls the same way the server gates
+requests. Mirror the `src/types/node-features.ts` pattern: a shared
+constant (`src/types/publisher-roles.ts`) with the role list + the
+capability map + a `can(role, cap)` helper, imported by both
+`functions/` and `src/ui/publisher/`. `GET /api/v1/publish/me` returns
+the caller's `role` (it already does) and gains a derived
+`capabilities: string[]` so the portal never hard-codes the matrix.
+
+### 7.3 Data model / migration
+
+- `0039_publisher_roles_five.sql` — no schema change (the `role` column
+  has no CHECK constraint, by design; see
+  `0005_publishers_audit.sql`). Additive backfill only:
+  `UPDATE publishers SET role='author' WHERE role='publisher';`
+  `UPDATE publishers SET role='reviewer' WHERE role='readonly';`
+  New rows (`editor`, `contributor`) need no backfill. `is_admin` stays
+  the synced mirror of `role='admin'`.
+- `ASSIGNABLE_ROLES` → `['admin','editor','author','contributor','reviewer']`.
+- Provisioning defaults tightened to least-privilege (**Decision D4**,
+  §8): untrusted-domain logins → `reviewer`/`pending`; trusted-domain
+  logins → `reviewer`/`active` (auto-approved, no longer auto-admin);
+  the first human on a deploy with no active admin is bootstrapped to
+  `admin`/`active` so a fresh deploy still has an operator.
+
+### 7.4 Portal UI
+
+- **Users tab** (`pages/users.ts`) — the role `<select>` grows from 3
+  options to 5, each with a one-line capability blurb. No structural
+  change; it already PATCHes `role`.
+- **Every gated page** already reads `can_edit`-style flags per row
+  (added in PR #283). Page-level chrome (New buttons, the events
+  Refresh, hero Set/Clear) switches from `clientIsPrivileged(me)` to
+  `can(me, cap)` using the shared constant.
+- **Contributor's missing publish** needs one new affordance: a
+  dataset/blog "Submit for review" state (draft that an Editor
+  publishes). Minimal version: Contributors simply lack the Publish
+  button; the draft sits in the queue for an Editor. A first-class
+  "submitted" sub-status is a **stretch** (D5).
+
+---
+
+## 8. Open decisions
+
+- **D1 — events approval tier.** Recommended: approving an *unclaimed*
+  event requires `content.publish.any` (Editor+); Authors approve only
+  their own. Alternative: keep PR #283's any-author-claims behavior.
+  *(This is the one behavior-reversal; needs an explicit call.)*
+- **D2 — rename `publisher→author`, `readonly→reviewer`?** Recommended:
+  yes, via additive backfill, for names that match the mental model.
+  Alternative: keep the wire strings, relabel in i18n only.
+- **D3 — `hero.manage` for Editor?** Recommended: yes (editorial call).
+  Alternative: keep hero admin-only.
+- **D4 — default role for a new login.** Resolved (least privilege):
+  untrusted-domain → `reviewer`/`pending`; trusted-domain → `reviewer`/
+  `active` (auto-approved, read-only — no longer auto-admin). To keep a
+  fresh deploy operable, the first human signing in while no active
+  admin exists is bootstrapped to `admin`/`active` (service tokens
+  excepted; the last-active-admin guardrail keeps this from re-firing).
+  This supersedes the earlier draft (`contributor`/`pending`) and the
+  legacy behavior (`publisher`/`pending`, trusted-domain → admin).
+- **D5 — first-class "submitted for review" status** for Contributor
+  drafts, vs. just "a draft an Editor can publish." Recommended: ship
+  the plain version first, add the sub-status only if the review
+  workflow needs it.
+
+---
+
+## 9. Phasing
+
+Each phase is independently shippable and, except where noted, tested
+before the next begins (per the repo's one-logical-change rule).
+
+- **R1 — Capability layer, zero behavior change.** Add
+  `capabilities.ts` + the shared constant; rewire existing gates to
+  `can(...)` so results are identical; matrix table tests. `me` returns
+  `capabilities`.
+- **R2 — Make Reviewer real.** `reviewer` (ex-`readonly`) loses
+  `content.create`/`edit`/`publish`. First actual behavior change:
+  fixes the no-op role. Users tab + docs updated.
+- **R3 — Editor role.** Grant `content.*.any` (+ `hero.manage` per D3).
+  Fold tours into the ownership-composed gates. Portal: Editors see
+  Edit/Publish on any row.
+- **R4 — Contributor role.** `content.create` + `edit.own` without
+  `publish.own`. Publish affordances hidden for Contributors across
+  datasets/blog/events; the D1 events reconciliation lands here.
+- **R5 — Polish.** Default-role decision (D4), optional submitted-status
+  (D5), provisioning copy, and folding this matrix into
+  `CATALOG_PUBLISHING_TOOLS.md` + the `publisher-store.ts` taxonomy
+  comment. Retire the deprecated `isPrivileged`/`isAdmin` aliases.
+
+---
+
+## 10. Testing posture
+
+- **Matrix table test** — the single source of truth; `role ×
+  capability → boolean`, asserted exhaustively so any cell change is a
+  reviewed diff.
+- **Per-endpoint gate tests** — one "allowed" + one "forbidden" case
+  per capability tier per route (extends the PR #283 suites, which
+  already stand up multi-role contexts).
+- **Ownership composition** — own-vs-others cases for each `*.own`
+  capability (already present for datasets/blog/events; extend to
+  tours).
+- **Portal gating** — the shared `can()` constant is unit-tested;
+  page tests assert the right controls appear per role (mirrors the
+  read-only tests added in PR #283).
+
+---
+
+## 11. Rollout / safety
+
+- The migration is additive and reversible (roles are free-text).
+  Existing `admin` and `publisher`(→`author`) accounts keep their
+  current effective powers; only `readonly`(→`reviewer`) *loses* the
+  authoring it was never supposed to have — a security tightening, not
+  a regression for any legitimate workflow.
+- No account is silently promoted. `editor` / `contributor` exist only
+  once an admin assigns them.
+- Because R1 is behavior-preserving and every later phase is gated
+  behind a role nobody holds yet (R3/R4) or a tightening of an unused
+  role (R2), the blast radius at each step is small and auditable.
diff --git a/docs/SELF_HOSTING.md b/docs/SELF_HOSTING.md
index 1dacc41c4..4a4f421c8 100644
--- a/docs/SELF_HOSTING.md
+++ b/docs/SELF_HOSTING.md
@@ -606,7 +606,7 @@ environments.
 | `NODE_ID_PRIVATE_KEY_PEM` | Secret | Ed25519 keypair for federation signing and `/.well-known/terraviz.json` advertisement. Generated with `npm run gen:node-key`. | Publishing anything. |
 | `PREVIEW_SIGNING_KEY` | Secret | HMAC-SHA-256 secret for preview-token signing. Without it the preview endpoints fail closed. | The CLI's `terraviz preview` command. |
 | `ACCESS_TEAM_DOMAIN` / `ACCESS_AUD` | Plaintext | Cloudflare Access app credentials for `/api/v1/publish/**`. Without them the publisher middleware 503s with `access_unconfigured`. | Publisher API access. |
-| `TRUSTED_PUBLISHER_DOMAINS` | Plaintext (optional) | Comma-separated email domains whose verified Access user logins JIT-provision as `admin/active/admin=1` instead of the default `publisher/pending`. Recommended for single-org deploys where the operator IS the admin (otherwise the first SSO sign-in lands at `pending` with no admin yet to approve it). Once one admin exists, additional users can be approved from the portal's Users tab instead. Match is exact, case-insensitive, no subdomain wildcarding. Service tokens are unaffected. | Single-org publisher portal access (Step 16). |
+| `TRUSTED_PUBLISHER_DOMAINS` | Plaintext (optional) | Comma-separated email domains whose verified Access user logins JIT-provision as `reviewer/active` — auto-approved (they skip the `pending` queue) but read-only, **not** admin. Everyone else defaults to `reviewer/pending`. An admin promotes trusted users to an authoring role from the portal's Users tab. You do **not** need this to seat your first admin: the first human to sign in on a deploy with no active admin is bootstrapped to `admin/active` automatically (service tokens excepted). Match is exact, case-insensitive, no subdomain wildcarding. Service tokens are unaffected. | Single-org publisher portal access (Step 16). |
 | `R2_PUBLIC_BASE` | Plaintext | Public origin for the catalog R2 bucket (e.g. `https://assets.terraviz.your-org.org`). The manifest endpoint and SPA build playable HLS / image / tour-asset URLs from this. Bind the domain under R2 → bucket → Settings → Connect Domain first. **Not optional for the audit** (see note below). | Serving any R2-hosted asset. |
 | `R2_S3_ENDPOINT` / `R2_ACCESS_KEY_ID` / `R2_SECRET_ACCESS_KEY` | Secret | R2 S3-API credentials for server-side presigned PUT minting and digest verification. Minted at R2 → Manage R2 API Tokens (Read+Write on the bucket). The same three values are also consumed shell-side by the migration CLIs and the transcode workflow. | Browser/CLI asset uploads. |
 | `GITHUB_OWNER` / `GITHUB_REPO` / `GITHUB_DISPATCH_TOKEN` | Plaintext / Plaintext / Secret | Point the video-transcode `repository_dispatch` at **your fork** (e.g. `your-org` / `terraviz`). Token is a PAT with `repo`/Contents:write on that repo. Without them video uploads 503 `github_dispatch_unconfigured`. | Video transcode (Step 15). |
diff --git a/functions/api/v1/_lib/blog-store.ts b/functions/api/v1/_lib/blog-store.ts
index c6e91c805..9f3aa2ba3 100644
--- a/functions/api/v1/_lib/blog-store.ts
+++ b/functions/api/v1/_lib/blog-store.ts
@@ -14,6 +14,7 @@
 
 import { newUlid } from './ulid'
 import type { PublisherRow } from './publisher-store'
+import { canOwnOrAny } from './capabilities'
 
 /** Bounds keep the stored payload sane; the portal enforces the same
  *  limits client-side. */
@@ -109,6 +110,20 @@ function parseDatasetIds(raw: string | null): string[] {
   }
 }
 
+/**
+ * Whether `publisher` may mutate (edit / publish / unpublish / delete)
+ * the given post. Mirrors the datasets rule: the post's author, or a
+ * privileged (admin / service) caller. Reads are open to every active
+ * publisher; this only gates writes. `drafting a post makes them an
+ * owner` is already true — `insertBlogPost` stamps `author_id`.
+ */
+export function canMutateBlogPost(
+  publisher: PublisherRow,
+  row: Pick<BlogPostRow, 'author_id'>,
+): boolean {
+  return canOwnOrAny(publisher, row.author_id, 'content.edit.own', 'content.edit.any')
+}
+
 export function toPublicPost(row: BlogPostRow): BlogPostPublic {
   return {
     id: row.id,
diff --git a/functions/api/v1/_lib/capabilities.test.ts b/functions/api/v1/_lib/capabilities.test.ts
new file mode 100644
index 000000000..ebebfe644
--- /dev/null
+++ b/functions/api/v1/_lib/capabilities.test.ts
@@ -0,0 +1,51 @@
+import { describe, expect, it } from 'vitest'
+import type { PublisherRow } from './publisher-store'
+import { can, canOwnOrAny } from './capabilities'
+
+function pub(role: string, id = 'PUB-1'): PublisherRow {
+  return {
+    id,
+    email: `${id}@example.com`,
+    display_name: id,
+    affiliation: null,
+    org_id: null,
+    role,
+    is_admin: role === 'admin' ? 1 : 0,
+    status: 'active',
+    created_at: '2026-01-01T00:00:00.000Z',
+  }
+}
+
+describe('can', () => {
+  it('resolves through the shared matrix (incl. legacy role strings)', () => {
+    expect(can(pub('admin'), 'users.manage')).toBe(true)
+    expect(can(pub('service'), 'users.manage')).toBe(false)
+    expect(can(pub('publisher'), 'content.create')).toBe(true) // legacy → author
+    expect(can(pub('publisher'), 'content.edit.any')).toBe(false)
+    expect(can(pub('editor'), 'content.publish.any')).toBe(true)
+    expect(can(pub('contributor'), 'content.publish.own')).toBe(false)
+  })
+})
+
+describe('canOwnOrAny', () => {
+  const author = pub('author', 'A')
+  const editor = pub('editor', 'E')
+
+  it('grants the owner via the .own capability', () => {
+    expect(canOwnOrAny(author, 'A', 'content.edit.own', 'content.edit.any')).toBe(true)
+  })
+  it('denies a non-owner who lacks the .any capability', () => {
+    expect(canOwnOrAny(author, 'SOMEONE-ELSE', 'content.edit.own', 'content.edit.any')).toBe(false)
+  })
+  it('grants any-holder regardless of ownership', () => {
+    expect(canOwnOrAny(editor, 'SOMEONE-ELSE', 'content.edit.own', 'content.edit.any')).toBe(true)
+  })
+  it('treats a null owner as not-owned (needs .any)', () => {
+    expect(canOwnOrAny(author, null, 'content.edit.own', 'content.edit.any')).toBe(false)
+    expect(canOwnOrAny(editor, null, 'content.edit.own', 'content.edit.any')).toBe(true)
+  })
+  it('denies a contributor from publishing even their own row', () => {
+    const contributor = pub('contributor', 'C')
+    expect(canOwnOrAny(contributor, 'C', 'content.publish.own', 'content.publish.any')).toBe(false)
+  })
+})
diff --git a/functions/api/v1/_lib/capabilities.ts b/functions/api/v1/_lib/capabilities.ts
new file mode 100644
index 000000000..fd3bd790b
--- /dev/null
+++ b/functions/api/v1/_lib/capabilities.ts
@@ -0,0 +1,37 @@
+/**
+ * Server-side capability check for the publisher API.
+ *
+ * Thin adapter over the shared, dependency-free role→capability matrix
+ * in `src/types/publisher-roles.ts` (the single source of truth, also
+ * imported by the portal). Route handlers and mutation helpers gate on
+ * `can(publisher, cap)` rather than `role === '...'`.
+ *
+ * Design: `docs/PUBLISHER_ROLES_PLAN.md`.
+ */
+
+import type { PublisherRow } from './publisher-store'
+import { type Capability, roleCan } from '../../../../src/types/publisher-roles'
+
+export type { Capability }
+
+/** Whether `publisher` holds `cap`. */
+export function can(publisher: PublisherRow, cap: Capability): boolean {
+  return roleCan(publisher.role, cap)
+}
+
+/**
+ * Ownership-composed check: `publisher` may act on `owned` when it can
+ * act on *any* row (`anyCap`) or when it owns the row and can act on
+ * *own* rows (`ownCap`). `ownerId` is the row's owner column
+ * (`publisher_id` / `author_id` / `owner_id`); a null owner is treated
+ * as not-owned (the caller must hold the `.any` capability).
+ */
+export function canOwnOrAny(
+  publisher: PublisherRow,
+  ownerId: string | null | undefined,
+  ownCap: Capability,
+  anyCap: Capability,
+): boolean {
+  if (can(publisher, anyCap)) return true
+  return ownerId != null && ownerId === publisher.id && can(publisher, ownCap)
+}
diff --git a/functions/api/v1/_lib/dataset-mutations.test.ts b/functions/api/v1/_lib/dataset-mutations.test.ts
index fd1fc318f..aa167b391 100644
--- a/functions/api/v1/_lib/dataset-mutations.test.ts
+++ b/functions/api/v1/_lib/dataset-mutations.test.ts
@@ -5,8 +5,11 @@
  *   - createDataset on a valid body inserts a draft (published_at NULL).
  *   - createDataset returns 400 + errors for invalid body.
  *   - Slug is derived from the title when missing, with collision suffix.
- *   - listDatasetsForPublisher honors the admin vs publisher filter.
+ *   - listDatasetsForPublisher returns the whole catalog to every role
+ *     (reads are open; writes stay owner-scoped).
  *   - listDatasetsForPublisher's status filter (draft/published/retracted).
+ *   - canMutateDataset / getDatasetById enforce the read-open,
+ *     write-owner-scoped split.
  *   - updateDataset patches fields, leaves others alone, invalidates KV
  *     when the row is currently public.
  *   - publishDataset stamps published_at + invalidates KV; rejects when
@@ -17,10 +20,12 @@
 import { describe, expect, it } from 'vitest'
 import type { PublisherRow } from './publisher-store'
 import {
+  canMutateDataset,
   createDataset,
   deleteDataset,
   DELETE_EMBEDDING_JOB_NAME,
   EMBED_JOB_NAME,
+  getDatasetById,
   getDatasetForPublisher,
   isEmbedConfigured,
   listDatasetsForPublisher,
@@ -181,12 +186,12 @@ describe('listDatasetsForPublisher', () => {
     expect(datasets).toHaveLength(3)
   })
 
-  it('filters to own rows for a publisher-role account', async () => {
+  it('returns the whole catalog to a publisher-role account (reads are open)', async () => {
     const { env } = setupEnv()
     await seed3(env)
     const { datasets } = await listDatasetsForPublisher(env.CATALOG_DB!, PUBLISHER)
-    expect(datasets).toHaveLength(2)
-    for (const d of datasets) expect(d.publisher_id).toBe(PUBLISHER.id)
+    // A community publisher now sees every row, not just its own two.
+    expect(datasets).toHaveLength(3)
   })
 
   it('honors ?status=draft|published|retracted', async () => {
@@ -208,6 +213,35 @@ describe('listDatasetsForPublisher', () => {
   })
 })
 
+describe('canMutateDataset', () => {
+  it('lets a publisher mutate only its own rows', () => {
+    expect(canMutateDataset(PUBLISHER, { publisher_id: PUBLISHER.id })).toBe(true)
+    expect(canMutateDataset(PUBLISHER, { publisher_id: ADMIN.id })).toBe(false)
+    expect(canMutateDataset(PUBLISHER, { publisher_id: null })).toBe(false)
+  })
+
+  it('lets a privileged (admin) caller mutate any row', () => {
+    expect(canMutateDataset(ADMIN, { publisher_id: PUBLISHER.id })).toBe(true)
+    expect(canMutateDataset(ADMIN, { publisher_id: null })).toBe(true)
+  })
+})
+
+describe('getDatasetById', () => {
+  it('reads any row regardless of owner (reads are open)', async () => {
+    const { env } = setupEnv()
+    const created = await createDataset(env, ADMIN, {
+      title: 'Admin dataset',
+      format: 'video/mp4',
+    })
+    expect(created.ok).toBe(true)
+    if (!created.ok) return
+    // Owned by ADMIN, but a community publisher can still read it.
+    const row = await getDatasetById(env.CATALOG_DB!, created.dataset.id)
+    expect(row?.id).toBe(created.dataset.id)
+    expect(await getDatasetById(env.CATALOG_DB!, 'does-not-exist')).toBeNull()
+  })
+})
+
 describe('getDatasetForPublisher', () => {
   it('respects the role-aware filter', async () => {
     const { env } = setupEnv()
diff --git a/functions/api/v1/_lib/dataset-mutations.ts b/functions/api/v1/_lib/dataset-mutations.ts
index e08b97632..705b01a36 100644
--- a/functions/api/v1/_lib/dataset-mutations.ts
+++ b/functions/api/v1/_lib/dataset-mutations.ts
@@ -7,9 +7,22 @@
  * upsert, role-aware visibility filters.
  *
  * Authorisation model:
- *   - `admin` and the synthetic `service` role see all rows.
- *   - `publisher` / `readonly` (and any role we don't recognise) see
- *     only rows where `publisher_id = caller.id`.
+ *   - Reads (list + single-row fetch) are open to every
+ *     authenticated publisher: everyone sees the whole node catalog.
+ *   - Writes (update / publish / retract / delete / preview / reindex)
+ *     stay owner-scoped: `admin` and the synthetic `service` role may
+ *     mutate any row; `publisher` / `readonly` (and any role we don't
+ *     recognise) may mutate only rows where `publisher_id = caller.id`.
+ *
+ * The split is enforced by two helpers:
+ *   - `getDatasetById` — unscoped read used by the list + detail
+ *     endpoints.
+ *   - `getDatasetForPublisher` — the owner-scoped gate the mutation
+ *     handlers pre-check with; returns null (→ 404) for a row the
+ *     caller may not mutate.
+ * `canMutateDataset` exposes the same rule to the route layer so the
+ * list / detail responses can stamp a per-row `can_edit` flag the
+ * portal uses to show or hide the Edit / Retract / Delete controls.
  *
  * Phase 1a is metadata-only: `data_ref` / `thumbnail_ref` /
  * `legend_ref` / `caption_ref` are bare strings supplied by the
@@ -18,6 +31,7 @@
  */
 
 import { type PublisherRow, isPrivileged } from './publisher-store'
+import { can, canOwnOrAny } from './capabilities'
 import type { DatasetRow } from './catalog-store'
 import { invalidateSnapshot } from './snapshot'
 import type { CatalogEnv } from './env'
@@ -124,16 +138,37 @@ export interface DraftCreateFailure {
 export type DraftCreateOutcome = DraftCreateResult | DraftCreateFailure
 
 /**
- * Apply the role-aware visibility predicate to an existing query.
+ * Apply the role-aware *mutation* predicate to an existing query.
  * Returns the WHERE fragment + binds to splice into the caller's
  * SQL. The fragment is a no-op (`'1=1'`) for privileged callers so
- * the caller can keep the SQL shape uniform.
+ * the caller can keep the SQL shape uniform. Reads no longer use
+ * this (the whole catalog is visible to every publisher); it now
+ * only gates the owner-scoped write path via `getDatasetForPublisher`.
  */
 function publisherScope(publisher: PublisherRow): { sql: string; binds: unknown[] } {
-  if (isPrivileged(publisher)) return { sql: '1=1', binds: [] }
+  // The mutation-visibility gate: callers who may edit any row see the
+  // whole table; everyone else only their own. (Editors gain
+  // `content.edit.any` in a later phase; today only admin/service hold
+  // it, so this is behavior-identical to the old isPrivileged check.)
+  if (can(publisher, 'content.edit.any')) return { sql: '1=1', binds: [] }
   return { sql: 'publisher_id = ?', binds: [publisher.id] }
 }
 
+/**
+ * Whether `publisher` may mutate (edit / publish / retract / delete /
+ * preview / reindex) the given row. Privileged callers may mutate
+ * anything; everyone else only their own rows. This is the single
+ * source of truth for the write rule — the mutation gate
+ * (`getDatasetForPublisher`) and the route layer's `can_edit` flag
+ * both derive from it.
+ */
+export function canMutateDataset(
+  publisher: PublisherRow,
+  row: Pick<DatasetRow, 'publisher_id'>,
+): boolean {
+  return canOwnOrAny(publisher, row.publisher_id, 'content.edit.own', 'content.edit.any')
+}
+
 /**
  * Collapse undefined / null / empty / whitespace-only strings to
  * NULL on the way to D1. Used by Phase 3d's `celestial_body`
@@ -156,16 +191,17 @@ export interface ListOptions {
 
 export async function listDatasetsForPublisher(
   db: D1Database,
-  publisher: PublisherRow,
+  // Every authenticated publisher sees the whole node catalog, so the
+  // list is no longer owner-scoped. The caller is retained in the
+  // signature because the route layer still needs it to stamp the
+  // per-row `can_edit` flag (see `canMutateDataset`), and to keep the
+  // call sites stable.
+  _publisher: PublisherRow,
   options: ListOptions = {},
 ): Promise<{ datasets: DatasetRow[]; next_cursor: string | null }> {
   const where: string[] = []
   const binds: unknown[] = []
 
-  const scope = publisherScope(publisher)
-  where.push(scope.sql)
-  binds.push(...scope.binds)
-
   if (options.status === 'draft') {
     where.push('published_at IS NULL AND retracted_at IS NULL')
   } else if (options.status === 'published') {
@@ -180,9 +216,12 @@ export async function listDatasetsForPublisher(
   }
 
   const limit = Math.min(Math.max(options.limit ?? 50, 1), 200)
+  // With no status/cursor filter the predicate list is empty, so omit
+  // the WHERE clause entirely rather than emit a dangling `WHERE`.
+  const whereClause = where.length ? `WHERE ${where.join(' AND ')}` : ''
   const sql = `
     SELECT * FROM datasets
-    WHERE ${where.join(' AND ')}
+    ${whereClause}
     ORDER BY id ASC
     LIMIT ?
   `
@@ -197,6 +236,24 @@ export async function listDatasetsForPublisher(
   return { datasets, next_cursor }
 }
 
+/**
+ * Unscoped single-row read by id. Backs the list + detail read
+ * endpoints, which are open to every authenticated publisher. Returns
+ * null only when the row genuinely does not exist. Mutation handlers
+ * must not use this — they gate on `getDatasetForPublisher` so the
+ * owner boundary is preserved.
+ */
+export async function getDatasetById(
+  db: D1Database,
+  id: string,
+): Promise<DatasetRow | null> {
+  const row = await db
+    .prepare('SELECT * FROM datasets WHERE id = ? LIMIT 1')
+    .bind(id)
+    .first<DatasetRow>()
+  return row ?? null
+}
+
 export async function getDatasetForPublisher(
   db: D1Database,
   publisher: PublisherRow,
@@ -922,6 +979,11 @@ export async function deleteDataset(
   if (!row) {
     return { ok: false, status: 404, error: 'not_found', message: `Dataset ${id} not found.` }
   }
+  // Ownership alone isn't enough — the caller must hold a delete/edit
+  // capability (a demoted read-only reviewer still owns its old rows).
+  if (!canMutateDataset(publisher, row)) {
+    return { ok: false, status: 403, error: 'forbidden_role', message: 'Deleting this dataset requires an authoring role.' }
+  }
   if (row.published_at && !row.retracted_at) {
     return {
       ok: false,
diff --git a/functions/api/v1/_lib/events-store.test.ts b/functions/api/v1/_lib/events-store.test.ts
index b6522cea7..3f797a664 100644
--- a/functions/api/v1/_lib/events-store.test.ts
+++ b/functions/api/v1/_lib/events-store.test.ts
@@ -399,6 +399,7 @@ describe('toPublicEvent', () => {
       image_url: null,
       image_alt: null,
       video_embed_url: null,
+      owner_id: null,
     }
     expect(toPublicEvent({ ...base, image_url: 'https://img.ex/story.jpg' }).imageUrl).toBe('https://img.ex/story.jpg')
     // eslint-disable-next-line no-script-url
@@ -435,6 +436,7 @@ describe('toPublicEvent', () => {
       reviewed_at: null,
       reviewed_by: null,
       inferred_fields: null,
+      owner_id: null,
     })
     expect(pub.geometry).toEqual({})
     expect(pub.summary).toBeUndefined()
diff --git a/functions/api/v1/_lib/events-store.ts b/functions/api/v1/_lib/events-store.ts
index a022b5254..55c0440f9 100644
--- a/functions/api/v1/_lib/events-store.ts
+++ b/functions/api/v1/_lib/events-store.ts
@@ -26,6 +26,8 @@
 
 import { newUlid } from './ulid'
 import { isNocookieEmbedUrl } from './youtube-channels'
+import type { PublisherRow } from './publisher-store'
+import { can, canOwnOrAny } from './capabilities'
 
 /** KV key the public `GET /api/v1/featured-event` caches under. Shared
  *  with the review route so an approve/reject can bust it for immediate
@@ -104,6 +106,11 @@ export interface CurrentEventRow {
   updated_at: string
   reviewed_at: string | null
   reviewed_by: string | null
+  /** Durable owner (publishers.id) — the creator of a manual event, or
+   *  the publisher who first approved a feed-proposed one. NULL while a
+   *  proposed event is still unclaimed. Distinct from `reviewed_by`
+   *  (the last curator to act). Gates the write path; reads are open. */
+  owner_id: string | null
   /** JSON array of AI-filled field names ('["occurredStart","geometry"]');
    *  NULL when everything came from the source (slice C provenance). */
   inferred_fields: string | null
@@ -194,6 +201,10 @@ export interface NewCurrentEvent {
   imageAlt?: string | null
   /** Curator-picked video embed url; feeds never carry one. */
   videoEmbedUrl?: string | null
+  /** Durable owner (publishers.id). The manual-create path sets this to
+   *  the creating publisher; the ingest path leaves it null (a feed
+   *  event is unclaimed until someone approves it). */
+  ownerId?: string | null
 }
 
 /** Fields a caller supplies to {@link upsertEventDatasetLink}. */
@@ -210,7 +221,7 @@ export interface NewEventDatasetLink {
 const EVENT_COLUMNS = `id, origin_node, title, summary, source_name, source_url,
   published_at, feed_id, external_id, occurred_start, occurred_end,
   bbox_n, bbox_s, bbox_w, bbox_e, point_lat, point_lon, region_name,
-  status, created_at, updated_at, reviewed_at, reviewed_by, inferred_fields, image_url, image_alt, video_embed_url`
+  status, created_at, updated_at, reviewed_at, reviewed_by, inferred_fields, image_url, image_alt, video_embed_url, owner_id`
 
 const LINK_COLUMNS = `event_id, dataset_id, match_score, signals_json,
   status, created_at, approved_at, approved_by`
@@ -260,12 +271,13 @@ export async function insertCurrentEvent(
     image_url: input.imageUrl ?? null,
     image_alt: input.imageAlt ?? null,
     video_embed_url: input.videoEmbedUrl ?? null,
+    owner_id: input.ownerId ?? null,
   }
 
   await db
     .prepare(
       `INSERT INTO current_events (${EVENT_COLUMNS})
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
     )
     .bind(
       row.id,
@@ -295,6 +307,7 @@ export async function insertCurrentEvent(
       row.image_url,
       row.image_alt,
       row.video_embed_url,
+      row.owner_id,
     )
     .run()
 
@@ -516,6 +529,56 @@ export async function expireStaleProposedEvents(
   return res.meta?.changes ?? 0
 }
 
+/**
+ * Whether `publisher` may mutate (review / edit / add image / generate
+ * tour for) the given event. Mirrors the datasets rule via
+ * `canOwnOrAny`: the owner writes with `content.edit.own`, and an
+ * unclaimed event (`owner_id === null`) requires `content.edit.any`
+ * (editor / admin / service) — a null owner has no `.own` match, so
+ * unclaimed events are editable only at the `.any` tier, not by any
+ * active publisher. Reads are always open; this only gates writes.
+ */
+export function canMutateEvent(
+  publisher: PublisherRow,
+  event: Pick<CurrentEventRow, 'owner_id'>,
+): boolean {
+  return canOwnOrAny(publisher, event.owner_id, 'content.edit.own', 'content.edit.any')
+}
+
+/**
+ * Whether `publisher` may **review** (approve/reject) the event or its
+ * dataset links — a publish-tier action, distinct from editing its
+ * metadata. Per decision D1 (`docs/PUBLISHER_ROLES_PLAN.md`): the
+ * event's owner with `content.publish.own` (an author approving their
+ * own manual event), or any `content.publish.any` holder (an editor /
+ * admin clearing the feed queue, which also claims an unclaimed event).
+ * A contributor can edit its own event's metadata but cannot approve
+ * it.
+ */
+export function canReviewEvent(
+  publisher: PublisherRow,
+  event: Pick<CurrentEventRow, 'owner_id'>,
+): boolean {
+  return canOwnOrAny(publisher, event.owner_id, 'content.publish.own', 'content.publish.any')
+}
+
+/**
+ * Claim ownership of an as-yet-unclaimed event. Sets `owner_id` only
+ * when it is currently NULL, so a later reviewer never steals ownership
+ * from the first approver. Called when a publisher approves a proposed
+ * event. Returns nothing — idempotent for an already-owned row.
+ */
+export async function claimEventOwner(
+  db: D1Database,
+  id: string,
+  ownerId: string,
+): Promise<void> {
+  await db
+    .prepare(`UPDATE current_events SET owner_id = ? WHERE id = ? AND owner_id IS NULL`)
+    .bind(ownerId, id)
+    .run()
+}
+
 /**
  * Transition an event's curator status, stamping the audit fields
  * (`reviewed_at` / `reviewed_by`) and `updated_at`. No-op result is the
diff --git a/functions/api/v1/_lib/publisher-store.test.ts b/functions/api/v1/_lib/publisher-store.test.ts
index 6ad6e974c..056aa57c6 100644
--- a/functions/api/v1/_lib/publisher-store.test.ts
+++ b/functions/api/v1/_lib/publisher-store.test.ts
@@ -3,8 +3,11 @@
  *
  * Coverage:
  *   - Lookup by email returns an existing row unchanged.
- *   - JIT defaults: user → publisher/pending, service → service/active,
- *     dev-bypass → admin/active.
+ *   - JIT defaults (steady state, an admin already seated): user →
+ *     reviewer/pending, trusted-domain → reviewer/active, service →
+ *     service/active, dev-bypass → admin/active.
+ *   - First-run bootstrap: the first human on a deploy with no active
+ *     admin is provisioned admin/active; service tokens are not.
  *   - Display name fallback uses the local-part of the email.
  *   - The minted ULID is 26 chars in Crockford-base32.
  */
@@ -14,6 +17,17 @@ import { getOrCreatePublisher, parseTrustedDomains } from './publisher-store'
 import { newUlid } from './ulid'
 import { asD1, seedFixtures } from './test-helpers'
 
+/** Seed one active admin so the first-run bootstrap does NOT fire and
+ *  the test exercises the steady-state provisioning defaults. */
+function seedActiveAdmin(sqlite: ReturnType<typeof seedFixtures>): void {
+  sqlite
+    .prepare(
+      `INSERT INTO publishers (id, email, display_name, role, is_admin, status, created_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?)`,
+    )
+    .run('PUB-SEED-ADMIN', 'seed-admin@example.com', 'Seed Admin', 'admin', 1, 'active', '2026-01-01T00:00:00.000Z')
+}
+
 const ALPHABET = '0123456789ABCDEFGHJKMNPQRSTVWXYZ'
 
 describe('newUlid', () => {
@@ -81,15 +95,16 @@ describe('getOrCreatePublisher', () => {
     expect(count.n).toBe(1)
   })
 
-  it('JIT-provisions publisher/pending for a new user identity', async () => {
+  it('JIT-provisions reviewer/pending for a new user identity (admin already seated)', async () => {
     const sqlite = seedFixtures({ count: 0 })
+    seedActiveAdmin(sqlite)
     const db = asD1(sqlite)
     const row = await getOrCreatePublisher(db, {
       email: 'newcomer@example.com',
       sub: 'sub-2',
       type: 'user',
     })
-    expect(row.role).toBe('publisher')
+    expect(row.role).toBe('reviewer')
     expect(row.is_admin).toBe(0)
     expect(row.status).toBe('pending')
     expect(row.email).toBe('newcomer@example.com')
@@ -97,6 +112,49 @@ describe('getOrCreatePublisher', () => {
     expect(row.id).toHaveLength(26)
   })
 
+  it('bootstraps the first human on a deploy with no active admin to admin/active', async () => {
+    const sqlite = seedFixtures({ count: 0 })
+    const db = asD1(sqlite)
+    const row = await getOrCreatePublisher(db, {
+      email: 'founder@example.com',
+      sub: 'sub-founder',
+      type: 'user',
+    })
+    expect(row.role).toBe('admin')
+    expect(row.is_admin).toBe(1)
+    expect(row.status).toBe('active')
+  })
+
+  it('does NOT bootstrap a service token as the first row', async () => {
+    const sqlite = seedFixtures({ count: 0 })
+    const db = asD1(sqlite)
+    const row = await getOrCreatePublisher(db, {
+      email: 'svc-first@service.local',
+      sub: 'svc-first',
+      type: 'service',
+    })
+    expect(row.role).toBe('service')
+    expect(row.is_admin).toBe(0)
+  })
+
+  it('bootstraps a human even when a service token is already the only row', async () => {
+    const sqlite = seedFixtures({ count: 0 })
+    const db = asD1(sqlite)
+    await getOrCreatePublisher(db, {
+      email: 'svc@service.local',
+      sub: 'svc',
+      type: 'service',
+    })
+    const human = await getOrCreatePublisher(db, {
+      email: 'operator@example.com',
+      sub: 'operator',
+      type: 'user',
+    })
+    expect(human.role).toBe('admin')
+    expect(human.is_admin).toBe(1)
+    expect(human.status).toBe('active')
+  })
+
   it('JIT-provisions service/active for a service token', async () => {
     const sqlite = seedFixtures({ count: 0 })
     const db = asD1(sqlite)
@@ -140,52 +198,57 @@ describe('getOrCreatePublisher', () => {
     expect(second.created_at).toBe(first.created_at)
   })
 
-  it('JIT-provisions admin/active for a trusted-domain user', async () => {
+  it('JIT-provisions reviewer/active for a trusted-domain user (admin already seated)', async () => {
     const sqlite = seedFixtures({ count: 0 })
+    seedActiveAdmin(sqlite)
     const db = asD1(sqlite)
     const row = await getOrCreatePublisher(
       db,
       { email: 'eric@noaa.gov', sub: 'user-eric', type: 'user' },
       { trustedDomains: new Set(['noaa.gov', 'zyra-project.org']) },
     )
-    expect(row.role).toBe('admin')
-    expect(row.is_admin).toBe(1)
+    expect(row.role).toBe('reviewer')
+    expect(row.is_admin).toBe(0)
     expect(row.status).toBe('active')
     expect(row.email).toBe('eric@noaa.gov')
   })
 
   it('domain match on trusted-domain check is case-insensitive', async () => {
     const sqlite = seedFixtures({ count: 0 })
+    seedActiveAdmin(sqlite)
     const db = asD1(sqlite)
     const row = await getOrCreatePublisher(
       db,
       { email: 'eric@NOAA.GOV', sub: 'user-eric', type: 'user' },
       { trustedDomains: new Set(['noaa.gov']) },
     )
-    expect(row.role).toBe('admin')
+    expect(row.role).toBe('reviewer')
+    expect(row.status).toBe('active')
   })
 
-  it('does NOT auto-promote a user from a subdomain that is not explicitly trusted', async () => {
+  it('does NOT auto-approve a user from a subdomain that is not explicitly trusted', async () => {
     const sqlite = seedFixtures({ count: 0 })
+    seedActiveAdmin(sqlite)
     const db = asD1(sqlite)
     const row = await getOrCreatePublisher(
       db,
       { email: 'eric@subteam.noaa.gov', sub: 'user-eric', type: 'user' },
       { trustedDomains: new Set(['noaa.gov']) },
     )
-    expect(row.role).toBe('publisher')
+    expect(row.role).toBe('reviewer')
     expect(row.status).toBe('pending')
   })
 
-  it('falls back to publisher/pending when trustedDomains is empty', async () => {
+  it('falls back to reviewer/pending when trustedDomains is empty (admin already seated)', async () => {
     const sqlite = seedFixtures({ count: 0 })
+    seedActiveAdmin(sqlite)
     const db = asD1(sqlite)
     const row = await getOrCreatePublisher(
       db,
       { email: 'eric@noaa.gov', sub: 'user-eric', type: 'user' },
       { trustedDomains: new Set() },
     )
-    expect(row.role).toBe('publisher')
+    expect(row.role).toBe('reviewer')
     expect(row.status).toBe('pending')
   })
 
diff --git a/functions/api/v1/_lib/publisher-store.ts b/functions/api/v1/_lib/publisher-store.ts
index fa4a8ef6a..204bdaedb 100644
--- a/functions/api/v1/_lib/publisher-store.ts
+++ b/functions/api/v1/_lib/publisher-store.ts
@@ -8,51 +8,71 @@
  * row.
  *
  * Role taxonomy (canonical privilege source of truth is `role`;
- * `is_admin` is a synced legacy mirror of `role === 'admin'`):
+ * `is_admin` is a synced legacy mirror of `role === 'admin'`). The
+ * capabilities each role holds live in the shared matrix
+ * `src/types/publisher-roles.ts`; this is the prose summary. See
+ * `docs/PUBLISHER_ROLES_PLAN.md`.
  *
- *   - `admin`     — full administrator (sees all rows, mutates
- *                   operator-scoped resources, manages users).
- *   - `publisher` — the secondary authoring role; sees only its own
- *                   rows, cannot manage users or operator resources.
- *   - `readonly`  — reviewer (unprivileged today; reviewer semantics
- *                   land later).
- *   - `service`   — machine credential / service token.
+ *   - `admin`       — full administrator (any content + operator
+ *                     resources + user management).
+ *   - `editor`      — publish/edit ANY content + the hero; no user or
+ *                     operator settings.
+ *   - `author`      — create + publish/edit its OWN content.
+ *   - `contributor` — create + edit its OWN drafts, but cannot
+ *                     self-publish (an editor/admin approves).
+ *   - `reviewer`    — read-only (catalog, queues, insights).
+ *   - `service`     — machine credential; admin-equivalent for content
+ *                     + operator work, but NOT user management.
  *
  * Status / role assignment:
  *
- * | Origin                                              | role        | is_admin | status   |
- * |-----------------------------------------------------|-------------|----------|----------|
- * | DEV_BYPASS_ACCESS=true                              | `admin`     | 1        | `active` |
- * | Access service token                                | `service`   | 0        | `active` |
- * | Access user, email domain in TRUSTED_PUBLISHER_DOMAINS | `admin`  | 1        | `active` |
- * | Access user, untrusted domain                       | `publisher` | 0        | `pending`|
+ * | Origin                                              | role       | is_admin | status   |
+ * |-----------------------------------------------------|------------|----------|----------|
+ * | DEV_BYPASS_ACCESS=true                              | `admin`    | 1        | `active` |
+ * | Access service token                                | `service`  | 0        | `active` |
+ * | First user on a deploy with no active admin (bootstrap) | `admin` | 1     | `active` |
+ * | Access user, email domain in TRUSTED_PUBLISHER_DOMAINS | `reviewer`| 0     | `active` |
+ * | Access user, untrusted domain                       | `reviewer` | 0        | `pending`|
  *
  * Service tokens are pre-vouched by whoever configured them in the
- * Cloudflare dashboard, so auto-`active` is safe. Trusted-domain
- * users are vouched by the operator's choice to list their domain
- * — appropriate for single-org deploys where the operator IS the
- * admin. Untrusted-domain user logins default to `publisher` /
- * `pending` so a stranger discovering the publisher API cannot start
- * authoring rows until an admin approves them in the portal's Users
- * tab.
+ * Cloudflare dashboard, so auto-`active` is safe. Trusted-domain users
+ * are vouched by the operator's choice to list their domain, so they
+ * skip the approval queue (`active`) — but start read-only (`reviewer`),
+ * NOT admin: auto-admin for a whole domain predates the role model and
+ * would silently make every colleague an admin. Untrusted-domain logins
+ * default to `reviewer` + `pending` so a stranger discovering the
+ * publisher API can author nothing until an admin approves (and
+ * optionally promotes) them in the portal's Users tab.
+ *
+ * The one exception is the **bootstrap**: the first human on a deploy
+ * with no active admin is provisioned `admin`/`active` (see
+ * {@link getOrCreatePublisher}) so there is always an operator who can
+ * approve/promote everyone else. It excludes service tokens (a machine
+ * credential must never self-elevate) and, because the last-active-admin
+ * guardrail on the Users tab keeps the admin count from ever reaching
+ * zero through normal operations, cannot re-fire as an escalation path.
  *
  * The `role` column has no SQL CHECK constraint (see
  * `migrations/catalog/0005_publishers_audit.sql`) so the role enum is
  * additive at the runtime layer without a schema migration. The
- * `0023_publisher_roles_two_tier.sql` migration backfilled the old
- * `staff`/`community` rows to `admin`/`publisher`.
+ * `0023_publisher_roles_two_tier.sql` migration backfilled
+ * `staff`/`community` → `admin`/`publisher`; `0039_publisher_roles_five.sql`
+ * renamed `publisher`/`readonly` → `author`/`reviewer`.
  */
 
 import type { AccessIdentity } from './access-auth'
 import { newUlid } from './ulid'
+import { roleCan, ASSIGNABLE_ROLES as ROLES_ASSIGNABLE, type Role } from '../../../../src/types/publisher-roles'
 
 /**
  * Roles an admin may assign to a publisher through the Users tab.
- * `service` is intentionally excluded — it is reserved for machine
- * tokens and provisioned automatically, never hand-assigned.
+ * Re-exported from the shared role matrix (`src/types/publisher-roles.ts`)
+ * so there is one source of truth. `service` is intentionally excluded —
+ * it is reserved for machine tokens and provisioned automatically,
+ * never hand-assigned.
  */
-export const ASSIGNABLE_ROLES = ['admin', 'publisher', 'readonly'] as const
-export type AssignableRole = (typeof ASSIGNABLE_ROLES)[number]
+export const ASSIGNABLE_ROLES = ROLES_ASSIGNABLE
+export type AssignableRole = Role
 
 /** Valid `status` values on the publishers table. */
 export const PUBLISHER_STATUSES = ['pending', 'active', 'suspended'] as const
@@ -121,17 +141,22 @@ export function provisioningDefaults(
 ): { role: string; is_admin: number; status: string } {
   if (opts.devBypass) return { role: 'admin', is_admin: 1, status: 'active' }
   if (identity.type === 'service') return { role: 'service', is_admin: 0, status: 'active' }
-  // Trusted-domain users are auto-promoted to admin/active. This is
-  // the supported path for single-org deploys where the operator IS
-  // the admin — pending-by-default would lock them out of their own
-  // deploy.
+  // Trusted-domain users skip the approval queue (`active`) but start
+  // read-only (`reviewer`), not admin — the operator promotes them from
+  // the Users tab as needed. (The first-ever human is bootstrapped to
+  // admin separately in getOrCreatePublisher, so a fresh deploy still
+  // gets an operator.)
   if (opts.trustedDomains && opts.trustedDomains.size > 0) {
     const domain = emailDomain(identity.email)
     if (domain && opts.trustedDomains.has(domain)) {
-      return { role: 'admin', is_admin: 1, status: 'active' }
+      return { role: 'reviewer', is_admin: 0, status: 'active' }
     }
   }
-  return { role: 'publisher', is_admin: 0, status: 'pending' }
+  // Untrusted-domain logins default to read-only `reviewer` + `pending`,
+  // so a stranger who discovers the publisher API can do nothing until
+  // an admin approves them and (if desired) promotes them to an
+  // authoring role (decision D4 in docs/PUBLISHER_ROLES_PLAN.md).
+  return { role: 'reviewer', is_admin: 0, status: 'pending' }
 }
 
 /**
@@ -151,7 +176,27 @@ export async function getOrCreatePublisher(
     .first<PublisherRow>()
   if (existing) return existing
 
-  const { role, is_admin, status } = provisioningDefaults(identity, options)
+  let { role, is_admin, status } = provisioningDefaults(identity, options)
+
+  // First-run bootstrap: if the deploy has no active admin yet, the
+  // first human to sign in becomes one, so there is always an operator
+  // who can approve/promote everyone else. Service tokens are excluded
+  // (a machine credential must never self-elevate). Gated on "no active
+  // admin" rather than "empty table" so a service-token-first deploy
+  // still bootstraps its first human; the last-active-admin guardrail on
+  // the Users tab keeps this count from dropping back to zero through
+  // normal operations, so this cannot re-fire as an escalation path.
+  if (identity.type === 'user' && is_admin === 0) {
+    const admins = await db
+      .prepare(`SELECT COUNT(*) AS n FROM publishers WHERE role = 'admin' AND status = 'active'`)
+      .first<{ n: number }>()
+    if ((admins?.n ?? 0) === 0) {
+      role = 'admin'
+      is_admin = 1
+      status = 'active'
+    }
+  }
+
   const row: PublisherRow = {
     id: newUlid(),
     email: identity.email,
@@ -198,29 +243,31 @@ export async function getOrCreatePublisher(
 }
 
 /**
- * Privileged callers see all rows and can mutate operator-scoped
- * resources (featured-list, peer config, hard delete). The role
- * table:
- *   - `admin` and `service` are privileged.
- *   - `publisher` and `readonly` are unprivileged.
+ * Privileged callers can mutate operator-scoped resources (feeds, node
+ * profile / identity, media config, featured list, hero, workflows,
+ * analytics backfill). Now a thin alias over the capability matrix:
+ * `operator.manage` is held by exactly `admin` + `service`, so this is
+ * behavior-identical to the old `role ∈ {admin, service}` check while
+ * the individual call sites are migrated to their specific capability
+ * (`hero.manage`, `content.publish.any`, …) in later phases.
  *
  * `role` is the canonical source of truth; the legacy `is_admin`
  * column is kept synced (`is_admin = 1` iff `role = 'admin'`) so it is
- * not consulted here. Read-side scoping in `dataset-mutations.ts`
- * consults this; the featured-datasets routes consult it for
- * write-side gating.
+ * not consulted here.
+ *
+ * Design: `docs/PUBLISHER_ROLES_PLAN.md`.
  */
 export function isPrivileged(publisher: PublisherRow): boolean {
-  return publisher.role === 'admin' || publisher.role === 'service'
+  return roleCan(publisher.role, 'operator.manage')
 }
 
 /**
- * Admin gate for user management. Strictly `role === 'admin'` —
- * unlike `isPrivileged`, this excludes `service` tokens, so machine
- * credentials cannot approve/suspend/promote other publishers. The
- * Users tab and its endpoints (`/api/v1/publish/publishers`) gate on
- * this.
+ * Admin gate for user management. `users.manage` is held by `admin`
+ * only (not `service`), so this preserves the old strict
+ * `role === 'admin'` semantics: machine credentials cannot
+ * approve/suspend/promote other publishers. The Users tab and its
+ * endpoints (`/api/v1/publish/publishers`) gate on this.
  */
 export function isAdmin(publisher: PublisherRow): boolean {
-  return publisher.role === 'admin'
+  return roleCan(publisher.role, 'users.manage')
 }
diff --git a/functions/api/v1/publish/analytics.test.ts b/functions/api/v1/publish/analytics.test.ts
index e33fc416d..3bddeb0aa 100644
--- a/functions/api/v1/publish/analytics.test.ts
+++ b/functions/api/v1/publish/analytics.test.ts
@@ -3,7 +3,7 @@
  * `docs/ANALYTICS_STORAGE_AND_ADMIN_PLAN.md`).
  *
  * Coverage:
- *   - 503 when CATALOG_DB is unbound; 403 for publisher callers.
+ *   - 503 when CATALOG_DB is unbound; read-only view open to publisher callers.
  *   - 400 on unknown section / days / environment / projection.
  *   - Section payloads computed from seeded rollup rows: overview
  *     day series + platform/country mixes + internal exclusion,
@@ -165,12 +165,14 @@ async function getData<T>(env: Record<string, unknown>, query: string): Promise<
 }
 
 describe('GET /api/v1/publish/analytics', () => {
-  it('503s without CATALOG_DB and 403s for publisher callers', async () => {
-    const { env } = setup()
+  it('503s without CATALOG_DB', async () => {
     expect((await analyticsGet(ctx({ env: {}, query: '?section=overview' }))).status).toBe(503)
-    expect(
-      (await analyticsGet(ctx({ env, publisher: PUBLISHER, query: '?section=overview' }))).status,
-    ).toBe(403)
+  })
+
+  it('is readable by a non-privileged (publisher-role) caller — read-only view access', async () => {
+    const { env } = setup()
+    const res = await analyticsGet(ctx({ env, publisher: PUBLISHER, query: '?section=overview' }))
+    expect(res.status).toBe(200)
   })
 
   it('400s on invalid parameters', async () => {
diff --git a/functions/api/v1/publish/analytics.ts b/functions/api/v1/publish/analytics.ts
index 85a2933cd..70656569a 100644
--- a/functions/api/v1/publish/analytics.ts
+++ b/functions/api/v1/publish/analytics.ts
@@ -15,14 +15,14 @@
  *     ?layer=<id>                                ('' = default Earth; omit = all)
  *     ?projection=globe|mercator|vr|ar           (omit = all)
  *
- * Privileged callers only (staff / admin / service) — same gate as
- * featured-hero. Responses are KV-cached ~5 minutes (key includes
+ * Read-only for any active publisher (view access); mutations
+ * elsewhere (the operator backfill in `analytics-export.ts`) stay
+ * privileged. Responses are KV-cached ~5 minutes (key includes
  * every filter) so a dashboard refresh storm stays cheap; rollups
  * only change once a day anyway.
  */
 
 import type { CatalogEnv } from '../_lib/env'
-import type { PublisherData } from './_middleware'
 import {
   queryDatasets,
   queryErrors,
@@ -35,7 +35,6 @@ import {
   type AnalyticsFilters,
 } from '../_lib/analytics-query'
 import { addDays, yesterdayUtc } from '../_lib/analytics-export'
-import { isPrivileged } from '../_lib/publisher-store'
 
 const CONTENT_TYPE = 'application/json; charset=utf-8'
 export const CACHE_TTL_SECONDS = 300
@@ -58,11 +57,9 @@ export const onRequestGet: PagesFunction<CatalogEnv> = async context => {
   if (!context.env.CATALOG_DB) {
     return jsonError(503, 'binding_missing', 'CATALOG_DB binding is not configured on this deployment.')
   }
-  const publisher = (context.data as unknown as PublisherData).publisher
-  if (!isPrivileged(publisher)) {
-    return jsonError(403, 'forbidden_role', 'Analytics is restricted to staff, admin, and service callers.')
-  }
-
+  // Read-only view is open to any active publisher (the middleware
+  // has already rejected pending / suspended accounts). No role gate
+  // here — analytics is a dashboard, not a mutation surface.
   const params = new URL(context.request.url).searchParams
   const section = params.get('section') ?? ''
   if (!(ALLOWED_SECTIONS as readonly string[]).includes(section)) {
diff --git a/functions/api/v1/publish/blog.test.ts b/functions/api/v1/publish/blog.test.ts
index e2345bdc8..2c98b3251 100644
--- a/functions/api/v1/publish/blog.test.ts
+++ b/functions/api/v1/publish/blog.test.ts
@@ -38,12 +38,14 @@ const DS_1 = 'DS001' + 'A'.repeat(21)
 
 function setupEnv() {
   const sqlite = seedFixtures({ count: 2 })
-  sqlite
-    .prepare(
-      `INSERT INTO publishers (id, email, display_name, role, is_admin, status, created_at)
-       VALUES (?, ?, ?, ?, ?, ?, ?)`,
-    )
-    .run(ADMIN.id, ADMIN.email, ADMIN.display_name, ADMIN.role, ADMIN.is_admin, ADMIN.status, ADMIN.created_at)
+  for (const p of [ADMIN, PUBLISHER]) {
+    sqlite
+      .prepare(
+        `INSERT INTO publishers (id, email, display_name, role, is_admin, status, created_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?)`,
+      )
+      .run(p.id, p.email, p.display_name, p.role, p.is_admin, p.status, p.created_at)
+  }
   return { sqlite, env: { CATALOG_DB: asD1(sqlite), CATALOG_KV: makeKV() } }
 }
 
@@ -93,10 +95,37 @@ async function createDraft(env: Record<string, unknown>, body: Record<string, un
 }
 
 describe('blog authoring routes', () => {
-  it('POST is 403 for a publisher-role account', async () => {
+  it('lets a publisher-role account create a draft and stamps them as author', async () => {
     const { env } = setupEnv()
     const res = await createPost(ctx({ env, method: 'POST', publisher: PUBLISHER, body: VALID }))
-    expect(res.status).toBe(403)
+    expect(res.status).toBe(201)
+    const { post } = await readJson<{ post: { id: string } }>(res)
+    // The author is the creating publisher, and it's editable by them.
+    const list = await authorList(ctx({ env, publisher: PUBLISHER }))
+    const { posts } = await readJson<{ posts: Array<{ id: string; authorId: string; can_edit: boolean }> }>(list)
+    const mine = posts.find(p => p.id === post.id)!
+    expect(mine.authorId).toBe(PUBLISHER.id)
+    expect(mine.can_edit).toBe(true)
+  })
+
+  it('a publisher cannot edit or publish a post authored by someone else (403 forbidden_owner)', async () => {
+    const { env } = setupEnv()
+    // ADMIN authors a post; PUBLISHER may read it but not mutate it.
+    const post = await createDraft(env) // ctx defaults to ADMIN
+    const listed = await authorList(ctx({ env, publisher: PUBLISHER }))
+    const { posts } = await readJson<{ posts: Array<{ id: string; can_edit: boolean }> }>(listed)
+    expect(posts.find(p => p.id === post.id)!.can_edit).toBe(false) // visible, not editable
+
+    const edit = await updateOne(
+      ctx({ env, method: 'PUT', publisher: PUBLISHER, params: { id: post.id }, body: VALID }),
+    )
+    expect(edit.status).toBe(403)
+    expect((await readJson<{ error: string }>(edit)).error).toBe('forbidden_owner')
+
+    const pub = await transition(
+      ctx({ env, method: 'POST', publisher: PUBLISHER, params: { id: post.id }, body: { action: 'publish' } }),
+    )
+    expect(pub.status).toBe(403)
   })
 
   it('create derives a slug, stores the draft, and audits blog.create', async () => {
diff --git a/functions/api/v1/publish/blog.ts b/functions/api/v1/publish/blog.ts
index 147576040..f49bd324f 100644
--- a/functions/api/v1/publish/blog.ts
+++ b/functions/api/v1/publish/blog.ts
@@ -3,27 +3,32 @@
  * `docs/CURRENT_EVENTS_PLAN.md` §7 companion work).
  *
  * GET  → All posts (drafts included), newest-updated first; optional
- *        `?status=draft|published`. Any signed-in publisher may read
- *        the authoring list.
+ *        `?status=draft|published`. Readable by any active publisher;
+ *        each post carries `can_edit` so the portal knows whether to
+ *        offer the authoring controls.
  * POST → Create a draft post. Body: `{ title, bodyMd, summary?,
- *        datasetIds?, eventId? }`. Privileged-only (admin / service),
- *        400 `{ errors }` for body problems, audit-logged
- *        (`blog.create`). Posts are born `draft`; publishing is a
- *        separate action on `/publish/blog/:id` — nothing
- *        auto-publishes.
+ *        datasetIds?, eventId? }`. Requires `content.create` (an
+ *        authoring role — contributor and up); reviewers are 403.
+ *        Drafting a post makes them its author/owner; thereafter the
+ *        author (via `content.edit.own`) or any `content.edit.any`
+ *        holder (editor / admin / service) may edit it. 400 `{ errors }`
+ *        for body problems, audit-logged (`blog.create`). Posts are born
+ *        `draft`; publishing is a separate action on
+ *        `/publish/blog/:id` — nothing auto-publishes.
  */
 
 import type { CatalogEnv } from '../_lib/env'
 import type { PublisherData } from './_middleware'
-import { isPrivileged } from '../_lib/publisher-store'
 import { writeAuditEvent } from '../_lib/audit-store'
 import {
+  canMutateBlogPost,
   insertBlogPost,
   listBlogPosts,
   toPublicPost,
   validateBlogInput,
   type BlogPostStatus,
 } from '../_lib/blog-store'
+import { can } from '../_lib/capabilities'
 
 const CONTENT_TYPE = 'application/json; charset=utf-8'
 
@@ -46,8 +51,16 @@ export const onRequestGet: PagesFunction<CatalogEnv> = async context => {
     }
     status = statusParam
   }
+  const publisher = (context.data as unknown as PublisherData).publisher
   const rows = await listBlogPosts(context.env.CATALOG_DB, { status })
-  return new Response(JSON.stringify({ posts: rows.map(toPublicPost) }), {
+  // Stamp per-post `can_edit` so the portal only offers the authoring
+  // controls on posts the caller may mutate (their own, or any as an
+  // admin). The whole list is readable regardless.
+  const posts = rows.map(row => ({
+    ...toPublicPost(row),
+    can_edit: canMutateBlogPost(publisher, row),
+  }))
+  return new Response(JSON.stringify({ posts }), {
     status: 200,
     headers: { 'Content-Type': CONTENT_TYPE, 'Cache-Control': 'private, no-store' },
   })
@@ -57,9 +70,12 @@ export const onRequestPost: PagesFunction<CatalogEnv> = async context => {
   if (!context.env.CATALOG_DB) {
     return jsonError(503, 'binding_missing', 'CATALOG_DB binding is not configured on this deployment.')
   }
+  // Any authoring role may create a draft; `insertBlogPost` stamps them
+  // as author, and only the author (or an editor/admin) may edit it
+  // after. Reviewers (read-only) are refused here.
   const publisher = (context.data as unknown as PublisherData).publisher
-  if (!isPrivileged(publisher)) {
-    return jsonError(403, 'forbidden_role', 'Creating blog posts is restricted to admin and service callers.')
+  if (!can(publisher, 'content.create')) {
+    return jsonError(403, 'forbidden_role', 'Creating blog posts requires an authoring role.')
   }
 
   let body: unknown
diff --git a/functions/api/v1/publish/blog/[id].ts b/functions/api/v1/publish/blog/[id].ts
index 8c0929444..ef25d9b96 100644
--- a/functions/api/v1/publish/blog/[id].ts
+++ b/functions/api/v1/publish/blog/[id].ts
@@ -2,14 +2,19 @@
  * /api/v1/publish/blog/:id — single-post authoring operations
  * (Phase 3d).
  *
- * GET  → The post, drafts included (any signed-in publisher).
+ * GET  → The post, drafts included (any active publisher). Carries
+ *        `can_edit` so the portal knows whether to offer authoring.
  * PUT  → Update content fields (`{ title, bodyMd, summary?,
  *        datasetIds?, eventId? }`). The slug never changes — published
- *        URLs stay stable across edits. Privileged-only.
+ *        URLs stay stable across edits. Owner-scoped via
+ *        `canMutateBlogPost`: the post's author (`content.edit.own`) or
+ *        any `content.edit.any` holder (editor / admin / service) may
+ *        edit.
  * POST → `{ action: 'publish' | 'unpublish' }` — the status
  *        transition. Publish is idempotent and keeps the first
- *        publish time; unpublish returns the post to draft.
- *        Privileged-only.
+ *        publish time; unpublish returns the post to draft. Gated on
+ *        publish capability: the author (`content.publish.own`) or any
+ *        `content.publish.any` holder (editor / admin / service).
  *
  * Every write is audit-logged (`blog.update` / `blog.publish` /
  * `blog.unpublish`) and busts the public blog caches so the change is
@@ -18,10 +23,12 @@
 
 import type { CatalogEnv } from '../../_lib/env'
 import type { PublisherData } from '../_middleware'
-import { isPrivileged } from '../../_lib/publisher-store'
+import type { PublisherRow } from '../../_lib/publisher-store'
+import { canOwnOrAny } from '../../_lib/capabilities'
 import { writeAuditEvent, type AuditAction } from '../../_lib/audit-store'
 import {
   bustBlogCache,
+  canMutateBlogPost,
   getBlogPost,
   publishBlogPost,
   toPublicPost,
@@ -45,22 +52,26 @@ function paramId(context: Parameters<PagesFunction<CatalogEnv, 'id'>>[0]): strin
   return id || null
 }
 
-function okPost(row: Parameters<typeof toPublicPost>[0]): Response {
-  return new Response(JSON.stringify({ post: toPublicPost(row) }), {
-    status: 200,
-    headers: { 'Content-Type': CONTENT_TYPE, 'Cache-Control': 'private, no-store' },
-  })
+function okPost(row: Parameters<typeof toPublicPost>[0], publisher: PublisherRow): Response {
+  return new Response(
+    JSON.stringify({ post: { ...toPublicPost(row), can_edit: canMutateBlogPost(publisher, row) } }),
+    {
+      status: 200,
+      headers: { 'Content-Type': CONTENT_TYPE, 'Cache-Control': 'private, no-store' },
+    },
+  )
 }
 
 export const onRequestGet: PagesFunction<CatalogEnv, 'id'> = async context => {
   if (!context.env.CATALOG_DB) {
     return jsonError(503, 'binding_missing', 'CATALOG_DB binding is not configured on this deployment.')
   }
+  const publisher = (context.data as unknown as PublisherData).publisher
   const id = paramId(context)
   if (!id) return jsonError(400, 'invalid_request', 'Missing post id.')
   const row = await getBlogPost(context.env.CATALOG_DB, id)
   if (!row) return jsonError(404, 'not_found', `Post ${id} not found.`)
-  return okPost(row)
+  return okPost(row, publisher)
 }
 
 export const onRequestPut: PagesFunction<CatalogEnv, 'id'> = async context => {
@@ -68,12 +79,17 @@ export const onRequestPut: PagesFunction<CatalogEnv, 'id'> = async context => {
     return jsonError(503, 'binding_missing', 'CATALOG_DB binding is not configured on this deployment.')
   }
   const publisher = (context.data as unknown as PublisherData).publisher
-  if (!isPrivileged(publisher)) {
-    return jsonError(403, 'forbidden_role', 'Editing blog posts is restricted to admin and service callers.')
-  }
   const id = paramId(context)
   if (!id) return jsonError(400, 'invalid_request', 'Missing post id.')
 
+  // Owner-scoped: only the author (or an admin) may edit. 404 for an
+  // unknown post; 403 for one the caller doesn't own.
+  const current = await getBlogPost(context.env.CATALOG_DB, id)
+  if (!current) return jsonError(404, 'not_found', `Post ${id} not found.`)
+  if (!canMutateBlogPost(publisher, current)) {
+    return jsonError(403, 'forbidden_owner', 'You can only edit blog posts you authored.')
+  }
+
   let body: unknown
   try {
     body = await context.request.json()
@@ -102,7 +118,7 @@ export const onRequestPut: PagesFunction<CatalogEnv, 'id'> = async context => {
   // A published post's content just changed — refresh the public reads.
   if (row.status === 'published') await bustBlogCache(context.env.CATALOG_KV, row.slug)
 
-  return okPost(row)
+  return okPost(row, publisher)
 }
 
 export const onRequestPost: PagesFunction<CatalogEnv, 'id'> = async context => {
@@ -110,9 +126,6 @@ export const onRequestPost: PagesFunction<CatalogEnv, 'id'> = async context => {
     return jsonError(503, 'binding_missing', 'CATALOG_DB binding is not configured on this deployment.')
   }
   const publisher = (context.data as unknown as PublisherData).publisher
-  if (!isPrivileged(publisher)) {
-    return jsonError(403, 'forbidden_role', 'Publishing blog posts is restricted to admin and service callers.')
-  }
   const id = paramId(context)
   if (!id) return jsonError(400, 'invalid_request', 'Missing post id.')
 
@@ -129,6 +142,20 @@ export const onRequestPost: PagesFunction<CatalogEnv, 'id'> = async context => {
 
   const existing = await getBlogPost(context.env.CATALOG_DB, id)
   if (!existing) return jsonError(404, 'not_found', `Post ${id} not found.`)
+  // Publishing is a privilege above editing: the author (own) or an
+  // editor/admin (any) may (un)publish. A contributor can draft + edit
+  // its own post but cannot publish it.
+  if (!canOwnOrAny(publisher, existing.author_id, 'content.publish.own', 'content.publish.any')) {
+    // Distinguish the two failure modes: the owner who simply lacks a
+    // publishing capability (e.g. a contributor) is a role problem;
+    // a non-owner without `content.publish.any` is an ownership problem.
+    const isOwner = existing.author_id === publisher.id
+    return jsonError(
+      403,
+      isOwner ? 'forbidden_role' : 'forbidden_owner',
+      'Publishing a blog post requires a publishing role.',
+    )
+  }
 
   const row =
     action === 'publish'
@@ -147,5 +174,5 @@ export const onRequestPost: PagesFunction<CatalogEnv, 'id'> = async context => {
   })
   await bustBlogCache(context.env.CATALOG_KV, row.slug)
 
-  return okPost(row)
+  return okPost(row, publisher)
 }
diff --git a/functions/api/v1/publish/blog/generate.test.ts b/functions/api/v1/publish/blog/generate.test.ts
index d7f0286fa..e9bfcd84a 100644
--- a/functions/api/v1/publish/blog/generate.test.ts
+++ b/functions/api/v1/publish/blog/generate.test.ts
@@ -59,12 +59,14 @@ function aiStub(reply: unknown = { response: DRAFT_REPLY }) {
 
 function setupEnv(ai?: ReturnType<typeof aiStub>) {
   const sqlite = seedFixtures({ count: 2 })
-  sqlite
-    .prepare(
-      `INSERT INTO publishers (id, email, display_name, role, is_admin, status, created_at)
-       VALUES (?, ?, ?, ?, ?, ?, ?)`,
-    )
-    .run(ADMIN.id, ADMIN.email, ADMIN.display_name, ADMIN.role, ADMIN.is_admin, ADMIN.status, ADMIN.created_at)
+  for (const p of [ADMIN, PUBLISHER]) {
+    sqlite
+      .prepare(
+        `INSERT INTO publishers (id, email, display_name, role, is_admin, status, created_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?)`,
+      )
+      .run(p.id, p.email, p.display_name, p.role, p.is_admin, p.status, p.created_at)
+  }
   // A node profile so the prompt grounding is observable.
   sqlite
     .prepare(
@@ -108,10 +110,10 @@ async function readJson<T>(res: Response): Promise<T> {
 }
 
 describe('POST /api/v1/publish/blog/generate', () => {
-  it('403 for a publisher-role account', async () => {
+  it('is allowed for an authoring-role account (gated on content.create; reviewers are refused)', async () => {
     const { env } = setupEnv(aiStub())
     const res = await generate(ctx({ env, publisher: PUBLISHER, body: { datasetIds: [DS_0] } }))
-    expect(res.status).toBe(403)
+    expect(res.status).toBe(200)
   })
 
   it('400 when no datasets are selected (or none are visible)', async () => {
diff --git a/functions/api/v1/publish/blog/generate.ts b/functions/api/v1/publish/blog/generate.ts
index 795920da5..2cd905b1e 100644
--- a/functions/api/v1/publish/blog/generate.ts
+++ b/functions/api/v1/publish/blog/generate.ts
@@ -24,7 +24,7 @@
 import type { CatalogEnv } from '../../_lib/env'
 import type { EnrichEnv } from '../../_lib/events-enrich'
 import type { PublisherData } from '../_middleware'
-import { isPrivileged } from '../../_lib/publisher-store'
+import { can } from '../../_lib/capabilities'
 import { writeAuditEvent } from '../../_lib/audit-store'
 import { getNodeProfile } from '../../_lib/node-profile-store'
 import { getEffectiveFeatures } from '../../_lib/node-settings-store'
@@ -56,9 +56,12 @@ export const onRequestPost: PagesFunction<CatalogEnv & EnrichEnv> = async contex
   if (!context.env.CATALOG_DB) {
     return jsonError(503, 'binding_missing', 'CATALOG_DB binding is not configured on this deployment.')
   }
+  // Authoring helper — open to any authoring role (they're drafting
+  // their own post; the companion tour it may create is owned by them).
+  // Reviewers (read-only) are refused.
   const publisher = (context.data as unknown as PublisherData).publisher
-  if (!isPrivileged(publisher)) {
-    return jsonError(403, 'forbidden_role', 'Generating blog drafts is restricted to admin and service callers.')
+  if (!can(publisher, 'content.create')) {
+    return jsonError(403, 'forbidden_role', 'Generating blog drafts requires an authoring role.')
   }
 
   let body: GenerateBody
diff --git a/functions/api/v1/publish/datasets.test.ts b/functions/api/v1/publish/datasets.test.ts
index 462f3601d..958db66f8 100644
--- a/functions/api/v1/publish/datasets.test.ts
+++ b/functions/api/v1/publish/datasets.test.ts
@@ -16,6 +16,7 @@ import { onRequestGet, onRequestPost } from './datasets'
 import {
   onRequestGet as datasetGet,
   onRequestPut as datasetPut,
+  onRequestDelete as datasetDelete,
 } from './datasets/[id]'
 import { onRequestPost as datasetPublish } from './datasets/[id]/publish'
 import { onRequestPost as datasetReindex } from './datasets/[id]/reindex'
@@ -36,6 +37,22 @@ const ADMIN: PublisherRow = {
   created_at: '2026-01-01T00:00:00.000Z',
 }
 
+// A second, non-privileged publisher — used to exercise the
+// read-open / write-owner-scoped split.
+const PUBLISHER: PublisherRow = {
+  ...ADMIN,
+  id: 'PUB-COMM',
+  email: 'comm@example.com',
+  display_name: 'Community',
+  role: 'author',
+  is_admin: 0,
+}
+
+// A read-only reviewer — may read but authors nothing.
+const REVIEWER: PublisherRow = { ...PUBLISHER, id: 'PUB-REVIEWER', email: 'r@e', role: 'reviewer' }
+// A contributor — may create + edit own drafts, but cannot publish.
+const CONTRIBUTOR: PublisherRow = { ...PUBLISHER, id: 'PUB-CONTRIB', email: 'co@e', role: 'contributor' }
+
 function ctxWithPublisher<P extends string = never>(opts: {
   env: Record<string, unknown>
   url?: string
@@ -43,6 +60,9 @@ function ctxWithPublisher<P extends string = never>(opts: {
   headers?: Record<string, string>
   body?: unknown
   params?: Record<string, string>
+  /** The authenticated publisher the middleware would have attached.
+   *  Defaults to ADMIN so the existing tests are unaffected. */
+  publisher?: PublisherRow
 }) {
   const url = opts.url ?? 'https://localhost/api/v1/publish/datasets'
   const headers = new Headers(opts.headers ?? {})
@@ -57,7 +77,7 @@ function ctxWithPublisher<P extends string = never>(opts: {
     request,
     env: opts.env,
     params: (opts.params ?? {}) as { [K in P]: string | string[] },
-    data: { publisher: ADMIN },
+    data: { publisher: opts.publisher ?? ADMIN },
     waitUntil: () => {},
     passThroughOnException: () => {},
     next: async () => new Response(null),
@@ -67,12 +87,14 @@ function ctxWithPublisher<P extends string = never>(opts: {
 
 function setupEnv() {
   const sqlite = seedFixtures({ count: 0 })
-  sqlite
-    .prepare(
-      `INSERT INTO publishers (id, email, display_name, role, is_admin, status, created_at)
-       VALUES (?, ?, ?, ?, ?, ?, ?)`,
-    )
-    .run(ADMIN.id, ADMIN.email, ADMIN.display_name, ADMIN.role, ADMIN.is_admin, ADMIN.status, ADMIN.created_at)
+  for (const p of [ADMIN, PUBLISHER, CONTRIBUTOR, REVIEWER]) {
+    sqlite
+      .prepare(
+        `INSERT INTO publishers (id, email, display_name, role, is_admin, status, created_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?)`,
+      )
+      .run(p.id, p.email, p.display_name, p.role, p.is_admin, p.status, p.created_at)
+  }
   return {
     sqlite,
     env: {
@@ -109,6 +131,15 @@ describe('POST /api/v1/publish/datasets', () => {
     expect(body.errors.length).toBeGreaterThan(0)
   })
 
+  it('returns 403 for a read-only reviewer (lacks content.create)', async () => {
+    const { env } = setupEnv()
+    const res = await onRequestPost(
+      ctxWithPublisher({ env, method: 'POST', body: { title: 'Nope', format: 'video/mp4' }, publisher: REVIEWER }),
+    )
+    expect(res.status).toBe(403)
+    expect((await readJson<{ error: string }>(res)).error).toBe('forbidden_role')
+  })
+
   it('returns 503 identity_missing when node_identity has not been provisioned', async () => {
     const { env, sqlite } = setupEnv()
     sqlite.prepare('DELETE FROM node_identity').run()
@@ -231,6 +262,143 @@ describe('GET / PUT /api/v1/publish/datasets/{id}', () => {
   })
 })
 
+describe('read-open / write-owner-scoped (whole-catalog visibility)', () => {
+  /** Seed one admin-owned row + one community-owned row. */
+  async function seedMixed() {
+    const { env, sqlite } = setupEnv()
+    const adminRow = await readJson<{ dataset: { id: string } }>(
+      await onRequestPost(
+        ctxWithPublisher({ env, method: 'POST', body: { title: 'Admin owned', format: 'video/mp4' } }),
+      ),
+    )
+    const commRow = await readJson<{ dataset: { id: string } }>(
+      await onRequestPost(
+        ctxWithPublisher({
+          env,
+          method: 'POST',
+          body: { title: 'Community owned', format: 'video/mp4' },
+          publisher: PUBLISHER,
+        }),
+      ),
+    )
+    return { env, sqlite, adminId: adminRow.dataset.id, commId: commRow.dataset.id }
+  }
+
+  it('GET list shows a community publisher the whole catalog with per-row can_edit', async () => {
+    const { env, adminId, commId } = await seedMixed()
+    const res = await onRequestGet(ctxWithPublisher({ env, publisher: PUBLISHER }))
+    expect(res.status).toBe(200)
+    const body = await readJson<{
+      datasets: Array<{ id: string; can_edit: boolean }>
+    }>(res)
+    // Both rows are visible, not just the community publisher's own.
+    expect(body.datasets.map(d => d.id).sort()).toEqual([adminId, commId].sort())
+    const byId = new Map(body.datasets.map(d => [d.id, d.can_edit]))
+    expect(byId.get(commId)).toBe(true) // own row → editable
+    expect(byId.get(adminId)).toBe(false) // someone else's → view-only
+  })
+
+  it('GET list marks every row can_edit for a privileged (admin) caller', async () => {
+    const { env, adminId, commId } = await seedMixed()
+    const res = await onRequestGet(ctxWithPublisher({ env, publisher: ADMIN }))
+    const body = await readJson<{ datasets: Array<{ id: string; can_edit: boolean }> }>(res)
+    for (const d of body.datasets) expect(d.can_edit).toBe(true)
+    expect(body.datasets.map(d => d.id).sort()).toEqual([adminId, commId].sort())
+  })
+
+  it('GET detail lets a community publisher read another owner’s row with can_edit=false', async () => {
+    const { env, adminId } = await seedMixed()
+    const res = await datasetGet(
+      ctxWithPublisher<'id'>({ env, params: { id: adminId }, publisher: PUBLISHER }),
+    )
+    expect(res.status).toBe(200)
+    const body = await readJson<{ dataset: { id: string; can_edit: boolean } }>(res)
+    expect(body.dataset.id).toBe(adminId)
+    expect(body.dataset.can_edit).toBe(false)
+  })
+
+  it('PUT stays owner-scoped: a community publisher gets 404 editing another owner’s row', async () => {
+    const { env, adminId } = await seedMixed()
+    const res = await datasetPut(
+      ctxWithPublisher<'id'>({
+        env,
+        method: 'PUT',
+        body: { title: 'Hijack attempt' },
+        params: { id: adminId },
+        publisher: PUBLISHER,
+      }),
+    )
+    expect(res.status).toBe(404)
+  })
+
+  it('PUT succeeds on the community publisher’s own row', async () => {
+    const { env, commId } = await seedMixed()
+    const res = await datasetPut(
+      ctxWithPublisher<'id'>({
+        env,
+        method: 'PUT',
+        body: { title: 'Renamed by owner' },
+        params: { id: commId },
+        publisher: PUBLISHER,
+      }),
+    )
+    expect(res.status).toBe(200)
+    const body = await readJson<{ dataset: { title: string } }>(res)
+    expect(body.dataset.title).toBe('Renamed by owner')
+  })
+})
+
+describe('a demoted read-only reviewer cannot edit/delete its own rows (security)', () => {
+  it('403s on PUT and DELETE for a reviewer-owned dataset', async () => {
+    const { env, sqlite } = setupEnv()
+    // Admin creates a draft, then it is reassigned to the reviewer (models
+    // an author who authored rows and was later demoted to reviewer).
+    const created = await onRequestPost(
+      ctxWithPublisher({ env, method: 'POST', body: { title: 'Was mine', format: 'video/mp4' } }),
+    )
+    const id = (await readJson<{ dataset: { id: string } }>(created)).dataset.id
+    sqlite.prepare('UPDATE datasets SET publisher_id = ? WHERE id = ?').run(REVIEWER.id, id)
+
+    const put = await datasetPut(
+      ctxWithPublisher<'id'>({ env, method: 'PUT', body: { title: 'edit' }, params: { id }, publisher: REVIEWER }),
+    )
+    expect(put.status).toBe(403)
+
+    const del = await datasetDelete(
+      ctxWithPublisher<'id'>({ env, method: 'DELETE', params: { id }, publisher: REVIEWER }),
+    )
+    expect(del.status).toBe(403)
+  })
+})
+
+describe('contributor cannot publish (R4)', () => {
+  it('lets a contributor create + edit its own draft but 403s on publish', async () => {
+    const { env } = setupEnv()
+    // Create as the contributor (content.create allowed).
+    const created = await onRequestPost(
+      ctxWithPublisher({
+        env,
+        method: 'POST',
+        body: { title: 'Contrib draft', format: 'video/mp4', data_ref: 'vimeo:1', license_spdx: 'CC-BY-4.0' },
+        publisher: CONTRIBUTOR,
+      }),
+    )
+    expect(created.status).toBe(201)
+    const id = (await readJson<{ dataset: { id: string } }>(created)).dataset.id
+    // Edit own draft → allowed.
+    const edit = await datasetPut(
+      ctxWithPublisher<'id'>({ env, method: 'PUT', body: { title: 'Edited' }, params: { id }, publisher: CONTRIBUTOR }),
+    )
+    expect(edit.status).toBe(200)
+    // Publish own draft → 403 (no content.publish.own).
+    const pub = await datasetPublish(
+      ctxWithPublisher<'id'>({ env, method: 'POST', params: { id }, publisher: CONTRIBUTOR }),
+    )
+    expect(pub.status).toBe(403)
+    expect((await readJson<{ error: string }>(pub)).error).toBe('forbidden_role')
+  })
+})
+
 describe('POST /api/v1/publish/datasets/{id}/publish', () => {
   async function seedReady() {
     const { env, sqlite } = setupEnv()
diff --git a/functions/api/v1/publish/datasets.ts b/functions/api/v1/publish/datasets.ts
index 251772623..6e60660f2 100644
--- a/functions/api/v1/publish/datasets.ts
+++ b/functions/api/v1/publish/datasets.ts
@@ -19,10 +19,12 @@ import type { PublisherData } from './_middleware'
 import { writeDatasetAudit } from '../_lib/audit-store'
 import { getNodeIdentity } from '../_lib/catalog-store'
 import {
+  canMutateDataset,
   createDataset,
   listDatasetsForPublisher,
   type ListOptions,
 } from '../_lib/dataset-mutations'
+import { can, canOwnOrAny } from '../_lib/capabilities'
 import { resolveHttpAssetUrl } from '../_lib/r2-public-url'
 
 const CONTENT_TYPE = 'application/json; charset=utf-8'
@@ -69,10 +71,16 @@ export const onRequestGet: PagesFunction<CatalogEnv> = async context => {
     options,
   )
   // Resolve each row's `thumbnail_ref` to a public URL so the list
-  // table can render a thumbnail cell (null when none / unresolvable).
+  // table can render a thumbnail cell (null when none / unresolvable),
+  // and stamp `can_edit` so the portal only shows the Edit / Retract /
+  // Delete controls on rows the caller may actually mutate. The whole
+  // catalog is now visible to every publisher, but writes stay
+  // owner-scoped.
   const withThumbnails = datasets.map(d => ({
     ...d,
     thumbnail_url: resolveHttpAssetUrl(context.env, d.thumbnail_ref),
+    can_edit: canMutateDataset(publisher, d),
+    can_publish: canOwnOrAny(publisher, d.publisher_id, 'content.publish.own', 'content.publish.any'),
   }))
   return new Response(JSON.stringify({ datasets: withThumbnails, next_cursor }), {
     status: 200,
@@ -82,6 +90,9 @@ export const onRequestGet: PagesFunction<CatalogEnv> = async context => {
 
 export const onRequestPost: PagesFunction<CatalogEnv> = async context => {
   const publisher = (context.data as unknown as PublisherData).publisher
+  if (!can(publisher, 'content.create')) {
+    return jsonError(403, 'forbidden_role', 'Creating datasets requires an authoring role.')
+  }
   // The mutation embeds the node_identity row id as `origin_node`
   // via `(SELECT node_id FROM node_identity LIMIT 1)`. If a
   // contributor hits POST before running `gen:node-key`, that
diff --git a/functions/api/v1/publish/datasets/[id].ts b/functions/api/v1/publish/datasets/[id].ts
index 4caf7f7c7..13b1533b2 100644
--- a/functions/api/v1/publish/datasets/[id].ts
+++ b/functions/api/v1/publish/datasets/[id].ts
@@ -2,11 +2,13 @@
  * /api/v1/publish/datasets/{id}
  *
  * GET → Single dataset full body (draft, published, retracted).
- *       Community publishers can only fetch rows they own; staff
- *       see anything. 404 when the row doesn't exist OR isn't
- *       visible — we don't distinguish, to avoid leaking the
- *       existence of other publishers' drafts.
- * PUT → Patch metadata. Same authorisation rule as GET.
+ *       Readable by any authenticated publisher — the whole node
+ *       catalog is visible. 404 only when the row doesn't exist. The
+ *       response carries `can_edit` so the portal knows whether to
+ *       offer the mutation controls.
+ * PUT → Patch metadata. Owner-scoped: only the row's publisher (or a
+ *       privileged caller) may write; others get 404 from the
+ *       ownership gate.
  *
  * DELETE → Hard-delete a non-published row (drafts + retracted).
  *       409 `published` for live rows (retract first) and
@@ -21,10 +23,13 @@ import type { PublisherData } from '../_middleware'
 import { writeDatasetAudit } from '../../_lib/audit-store'
 import { getDecorations } from '../../_lib/catalog-store'
 import {
+  canMutateDataset,
   deleteDataset,
+  getDatasetById,
   getDatasetForPublisher,
   updateDataset,
 } from '../../_lib/dataset-mutations'
+import { canOwnOrAny } from '../../_lib/capabilities'
 import { resolveHttpAssetUrl } from '../../_lib/r2-public-url'
 import { type JobQueue, WaitUntilJobQueue } from '../../_lib/job-queue'
 
@@ -53,7 +58,7 @@ export const onRequestGet: PagesFunction<CatalogEnv, 'id'> = async context => {
   const id = pickId(context)
   if (!id) return jsonError(400, 'invalid_request', 'Missing dataset id.')
   const db = context.env.CATALOG_DB!
-  const row = await getDatasetForPublisher(db, publisher, id)
+  const row = await getDatasetById(db, id)
   if (!row) return jsonError(404, 'not_found', `Dataset ${id} not found.`)
   const decorations = (await getDecorations(db, [id])).get(id)
   // Resolve the raw `data_ref` (`r2:<key>` or a bare URL) to a
@@ -70,7 +75,15 @@ export const onRequestGet: PagesFunction<CatalogEnv, 'id'> = async context => {
   const legendUrl = resolveHttpAssetUrl(context.env, row.legend_ref)
   return new Response(
     JSON.stringify({
-      dataset: row,
+      // `can_edit` / `can_publish` ride on the dataset object so the
+      // portal gates edit vs publish controls independently — a
+      // contributor edits its own draft (can_edit) but cannot publish
+      // it (can_publish false).
+      dataset: {
+        ...row,
+        can_edit: canMutateDataset(publisher, row),
+        can_publish: canOwnOrAny(publisher, row.publisher_id, 'content.publish.own', 'content.publish.any'),
+      },
       data_url: dataUrl,
       thumbnail_url: thumbnailUrl,
       legend_url: legendUrl,
@@ -90,6 +103,12 @@ export const onRequestPut: PagesFunction<CatalogEnv, 'id'> = async context => {
   if (!id) return jsonError(400, 'invalid_request', 'Missing dataset id.')
   const existing = await getDatasetForPublisher(context.env.CATALOG_DB!, publisher, id)
   if (!existing) return jsonError(404, 'not_found', `Dataset ${id} not found.`)
+  // Ownership alone isn't enough: a caller must hold an edit capability
+  // (a read-only reviewer demoted after authoring still owns rows). This
+  // matches the blog/events write gates (canMutateBlogPost / canMutateEvent).
+  if (!canMutateDataset(publisher, existing)) {
+    return jsonError(403, 'forbidden_role', 'Editing this dataset requires an authoring role.')
+  }
 
   let body: unknown
   try {
diff --git a/functions/api/v1/publish/datasets/[id]/publish.ts b/functions/api/v1/publish/datasets/[id]/publish.ts
index b7d5b9dbe..62c88c6da 100644
--- a/functions/api/v1/publish/datasets/[id]/publish.ts
+++ b/functions/api/v1/publish/datasets/[id]/publish.ts
@@ -17,6 +17,7 @@ import {
   getDatasetForPublisher,
   publishDataset,
 } from '../../../_lib/dataset-mutations'
+import { canOwnOrAny } from '../../../_lib/capabilities'
 import { type JobQueue, WaitUntilJobQueue } from '../../../_lib/job-queue'
 
 /** Test injection point — middleware/tests can pre-populate `context.data.jobQueue`. */
@@ -41,6 +42,12 @@ export const onRequestPost: PagesFunction<CatalogEnv, 'id'> = async context => {
 
   const existing = await getDatasetForPublisher(context.env.CATALOG_DB!, publisher, id)
   if (!existing) return jsonError(404, 'not_found', `Dataset ${id} not found.`)
+  // Publishing is a privilege above editing: a contributor can draft +
+  // edit its own rows but cannot make them public — an author (own) or
+  // an editor/admin (any) publishes.
+  if (!canOwnOrAny(publisher, existing.publisher_id, 'content.publish.own', 'content.publish.any')) {
+    return jsonError(403, 'forbidden_role', 'Publishing requires a publishing role.')
+  }
 
   const jobQueue =
     (context.data as unknown as PublishContextData).jobQueue ??
diff --git a/functions/api/v1/publish/datasets/[id]/retract.ts b/functions/api/v1/publish/datasets/[id]/retract.ts
index f5bf8f6c2..7e668490a 100644
--- a/functions/api/v1/publish/datasets/[id]/retract.ts
+++ b/functions/api/v1/publish/datasets/[id]/retract.ts
@@ -11,6 +11,7 @@
 import type { CatalogEnv } from '../../../_lib/env'
 import type { PublisherData } from '../../_middleware'
 import { writeDatasetAudit } from '../../../_lib/audit-store'
+import { canOwnOrAny } from '../../../_lib/capabilities'
 import {
   getDatasetForPublisher,
   retractDataset,
@@ -39,6 +40,11 @@ export const onRequestPost: PagesFunction<CatalogEnv, 'id'> = async context => {
 
   const existing = await getDatasetForPublisher(context.env.CATALOG_DB!, publisher, id)
   if (!existing) return jsonError(404, 'not_found', `Dataset ${id} not found.`)
+  // Retract is a publish-tier action (it changes public visibility) —
+  // same gate as publish.
+  if (!canOwnOrAny(publisher, existing.publisher_id, 'content.publish.own', 'content.publish.any')) {
+    return jsonError(403, 'forbidden_role', 'Retracting requires a publishing role.')
+  }
 
   const jobQueue =
     (context.data as unknown as RetractContextData).jobQueue ??
diff --git a/functions/api/v1/publish/events.test.ts b/functions/api/v1/publish/events.test.ts
index f2af104b1..22c4f9ee6 100644
--- a/functions/api/v1/publish/events.test.ts
+++ b/functions/api/v1/publish/events.test.ts
@@ -2,7 +2,7 @@
  * Wire-level tests for GET /api/v1/publish/events — the current-events
  * review queue.
  *
- * Coverage: privileged gate (403 for publisher), the assembled
+ * Coverage: read-open / create-owns access model, the assembled
  * event+links+title shape, the `?status` filter, 400 for a bad status,
  * and 503 when CATALOG_DB is unbound.
  */
@@ -15,6 +15,7 @@ import {
   upsertEventDatasetLink,
   setEventStatus,
   listCurrentEvents,
+  getCurrentEvent,
   listLinksForEvent,
   getEventDecorations,
 } from '../_lib/events-store'
@@ -71,10 +72,10 @@ const SAMPLE = {
 }
 
 describe('GET /api/v1/publish/events', () => {
-  it('403 for a publisher-role account', async () => {
+  it('is readable by a publisher-role account (whole-queue read access)', async () => {
     const { env } = setupEnv()
     const res = await eventsGet(ctx({ env, publisher: PUBLISHER }))
-    expect(res.status).toBe(403)
+    expect(res.status).toBe(200)
   })
 
   it('503 when CATALOG_DB is unbound', async () => {
@@ -177,10 +178,16 @@ const CREATE = {
 }
 
 describe('POST /api/v1/publish/events', () => {
-  it('403 for a publisher-role account', async () => {
-    const { env } = setupEnv()
+  it('lets a publisher-role account create an event and makes them the owner', async () => {
+    const { env, sqlite } = setupEnv()
     const res = await eventsPost(postCtx({ env, publisher: PUBLISHER, body: CREATE }))
-    expect(res.status).toBe(403)
+    expect(res.status).toBe(201)
+    const body = JSON.parse(await res.text()) as { event: { id: string } }
+    // The creating publisher is stamped as owner.
+    const row = sqlite
+      .prepare(`SELECT owner_id FROM current_events WHERE id = ?`)
+      .get(body.event.id) as { owner_id: string | null }
+    expect(row.owner_id).toBe(PUBLISHER.id)
   })
 
   it('400 when provenance is missing', async () => {
@@ -227,6 +234,35 @@ describe('POST /api/v1/publish/events', () => {
     expect(all[0].title).toBe('Hurricane Lena (updated)')
   })
 
+  it('a non-publish.any author cannot overwrite an existing feed event via (feedId, externalId)', async () => {
+    // Security: the idempotent upsert must not let a lower authoring
+    // role rewrite an event it does not own. Admin seeds a feed event…
+    const { env } = setupEnv()
+    const seeded = JSON.parse(
+      await (await eventsPost(postCtx({ env, body: CREATE }))).text(),
+    ) as { event: { id: string } }
+
+    // …an author POSTs the SAME feed key with hijacked content.
+    const res = await eventsPost(
+      postCtx({
+        env,
+        publisher: PUBLISHER, // role 'publisher' → author (no publish.any)
+        body: { ...CREATE, title: 'HIJACKED', source: { name: 'Evil', url: 'https://evil.example/x' } },
+      }),
+    )
+    expect(res.status).toBe(201) // a fresh manual event, not an update
+    const body = JSON.parse(await res.text()) as { created: boolean; event: { id: string } }
+    expect(body.created).toBe(true)
+    expect(body.event.id).not.toBe(seeded.event.id)
+
+    // The original event is untouched, and the author's row carries no feed key.
+    const original = await getCurrentEvent(env.CATALOG_DB, seeded.event.id)
+    expect(original!.title).toBe(CREATE.title)
+    const hijack = await getCurrentEvent(env.CATALOG_DB, body.event.id)
+    expect(hijack!.feed_id).toBeNull()
+    expect(hijack!.external_id).toBeNull()
+  })
+
   it('persists published_at from source.publishedAt', async () => {
     const { env } = setupEnv()
     const res = await eventsPost(postCtx({ env, body: CREATE }))
diff --git a/functions/api/v1/publish/events.ts b/functions/api/v1/publish/events.ts
index 755dd91c2..7a5745494 100644
--- a/functions/api/v1/publish/events.ts
+++ b/functions/api/v1/publish/events.ts
@@ -19,10 +19,11 @@
 
 import type { CatalogEnv } from '../_lib/env'
 import type { PublisherData } from './_middleware'
-import { isPrivileged } from '../_lib/publisher-store'
 import { writeAuditEvent } from '../_lib/audit-store'
 import { parseCreate, resolveOriginNode, ingestEvent, type FieldError } from '../_lib/events-ingest'
+import { can } from '../_lib/capabilities'
 import {
+  canMutateEvent,
   listCurrentEvents,
   listLinksForEvent,
   listLinksForEvents,
@@ -83,10 +84,11 @@ export const onRequestGet: PagesFunction<CatalogEnv> = async context => {
   if (!context.env.CATALOG_DB) {
     return jsonError(503, 'binding_missing', 'CATALOG_DB binding is not configured on this deployment.')
   }
+  // Read-only view of the whole events queue is open to any active
+  // publisher (the middleware has already rejected pending / suspended).
+  // Per-event `can_edit` below tells the portal which rows the caller
+  // may act on; the write endpoints enforce it independently.
   const publisher = (context.data as unknown as PublisherData).publisher
-  if (!isPrivileged(publisher)) {
-    return jsonError(403, 'forbidden_role', 'The events review queue is restricted to admin and service callers.')
-  }
 
   // `?status=` narrows to one bucket; `?status=all` lists every status
   // (so a curator can find + manage already-reviewed events); omitted
@@ -117,6 +119,7 @@ export const onRequestGet: PagesFunction<CatalogEnv> = async context => {
     const decorations = decorationsByEvent.get(row.id) ?? { categories: {}, keywords: [] }
     return {
       ...toPublicEvent(row, decorations),
+      can_edit: canMutateEvent(publisher, row),
       links: links.map(l => toPublicLink(l, titles.get(l.dataset_id) ?? null)),
     }
   })
@@ -140,9 +143,14 @@ export const onRequestPost: PagesFunction<CatalogEnv> = async context => {
   if (!context.env.CATALOG_DB) {
     return jsonError(503, 'binding_missing', 'CATALOG_DB binding is not configured on this deployment.')
   }
+  // Any authoring role may create a manual event, and doing so makes
+  // them its owner (symmetric with drafting a blog / creating a
+  // dataset). It still starts `proposed` and needs approval to surface
+  // publicly, but only the creator / an editor / admin may edit it
+  // thereafter. Reviewers (read-only) are refused.
   const publisher = (context.data as unknown as PublisherData).publisher
-  if (!isPrivileged(publisher)) {
-    return jsonError(403, 'forbidden_role', 'Creating events is restricted to admin and service callers.')
+  if (!can(publisher, 'content.create')) {
+    return jsonError(403, 'forbidden_role', 'Creating events requires an authoring role.')
   }
 
   let body: unknown
@@ -156,7 +164,24 @@ export const onRequestPost: PagesFunction<CatalogEnv> = async context => {
   if (!parsed.ok) return validationFailure(parsed.errors)
 
   const db = context.env.CATALOG_DB
-  const input: NewCurrentEvent = { ...parsed.value, originNode: await resolveOriginNode(db) }
+  // The `(feedId, externalId)` pair makes `ingestEvent` idempotent — a
+  // second POST with a matching pair UPDATES the existing row's content
+  // in place, with no ownership check. That upsert is only safe for a
+  // caller who may edit any event (feed connectors run under the
+  // service token; an editor/admin manages the whole queue). A lower
+  // authoring role (author / contributor) must not be able to supply a
+  // feed key and overwrite an event it does not own — including a
+  // curator-approved, publicly-surfaced one. So we strip the feed key
+  // for anyone without `content.publish.any`: their POST always mints a
+  // fresh, feed-less manual event they own.
+  const mayUpsertFeedEvent = can(publisher, 'content.publish.any')
+  const input: NewCurrentEvent = {
+    ...parsed.value,
+    feedId: mayUpsertFeedEvent ? parsed.value.feedId : null,
+    externalId: mayUpsertFeedEvent ? parsed.value.externalId : null,
+    originNode: await resolveOriginNode(db),
+    ownerId: publisher.id,
+  }
 
   // Idempotent on the feed dedupe key, runs the matcher inline so the
   // review queue is pre-populated — shared with the refresh route. The
diff --git a/functions/api/v1/publish/events/[id].test.ts b/functions/api/v1/publish/events/[id].test.ts
index 8ba1c7829..049c2e924 100644
--- a/functions/api/v1/publish/events/[id].test.ts
+++ b/functions/api/v1/publish/events/[id].test.ts
@@ -2,7 +2,7 @@
  * Wire-level tests for POST /api/v1/publish/events/:id — the curator
  * review-submit.
  *
- * Coverage: privileged gate (403), 404 unknown event, 400 empty body,
+ * Coverage: owner-scoped write gate, 404 unknown event, 400 empty body,
  * 400 unknown link, event approve, per-link approve/reject, and the
  * `event.reviewed` audit row.
  */
@@ -29,19 +29,23 @@ const ADMIN: PublisherRow = {
   status: 'active',
   created_at: '2026-01-01T00:00:00.000Z',
 }
-const PUBLISHER: PublisherRow = { ...ADMIN, id: 'PUB-PUBLISHER', email: 'c@e', role: 'publisher', is_admin: 0 }
+const PUBLISHER: PublisherRow = { ...ADMIN, id: 'PUB-PUBLISHER', email: 'c@e', role: 'author', is_admin: 0 }
+const EDITOR: PublisherRow = { ...ADMIN, id: 'PUB-EDITOR', email: 'ed@e', role: 'editor', is_admin: 0 }
+const CONTRIBUTOR: PublisherRow = { ...ADMIN, id: 'PUB-CONTRIB', email: 'co@e', role: 'contributor', is_admin: 0 }
 
 const DS_0 = 'DS000' + 'A'.repeat(21)
 const DS_1 = 'DS001' + 'A'.repeat(21)
 
 function setupEnv() {
   const sqlite = seedFixtures({ count: 2 })
-  sqlite
-    .prepare(
-      `INSERT INTO publishers (id, email, display_name, role, is_admin, status, created_at)
-       VALUES (?, ?, ?, ?, ?, ?, ?)`,
-    )
-    .run(ADMIN.id, ADMIN.email, ADMIN.display_name, ADMIN.role, ADMIN.is_admin, ADMIN.status, ADMIN.created_at)
+  for (const p of [ADMIN, PUBLISHER, EDITOR, CONTRIBUTOR]) {
+    sqlite
+      .prepare(
+        `INSERT INTO publishers (id, email, display_name, role, is_admin, status, created_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?)`,
+      )
+      .run(p.id, p.email, p.display_name, p.role, p.is_admin, p.status, p.created_at)
+  }
   return { sqlite, env: { CATALOG_DB: asD1(sqlite) } }
 }
 
@@ -81,11 +85,71 @@ async function seedEventWithLink(env: { CATALOG_DB: D1Database }) {
 }
 
 describe('POST /api/v1/publish/events/:id', () => {
-  it('403 for a publisher-role account', async () => {
+  it('lets an editor approve an unclaimed event and claims ownership for them (D1)', async () => {
     const { env } = setupEnv()
     const id = await seedEventWithLink(env)
+    const res = await reviewPost(ctx({ env, id, publisher: EDITOR, body: { event: 'approve' } }))
+    expect(res.status).toBe(200)
+    const row = await getCurrentEvent(env.CATALOG_DB, id)
+    expect(row!.status).toBe('approved')
+    expect(row!.owner_id).toBe(EDITOR.id) // approving claimed it
+    const body = JSON.parse(await res.text()) as { event: { can_edit: boolean } }
+    expect(body.event.can_edit).toBe(true)
+  })
+
+  it('403 when an author touches an UNCLAIMED feed event (Editor territory — D1)', async () => {
+    const { env } = setupEnv()
+    const id = await seedEventWithLink(env) // owner_id null
+    // An author can neither edit nor approve an unclaimed feed event —
+    // it fails the baseline edit gate (needs edit.any).
     const res = await reviewPost(ctx({ env, id, publisher: PUBLISHER, body: { event: 'approve' } }))
     expect(res.status).toBe(403)
+    expect((JSON.parse(await res.text()) as { error: string }).error).toBe('forbidden_owner')
+  })
+
+  it('lets an author approve their OWN event (publish.own)', async () => {
+    const { env } = setupEnv()
+    const id = (await insertCurrentEvent(env.CATALOG_DB, { ...SAMPLE, ownerId: PUBLISHER.id })).id
+    await upsertEventDatasetLink(env.CATALOG_DB, { eventId: id, datasetId: DS_0, matchScore: 0.9 })
+    const res = await reviewPost(ctx({ env, id, publisher: PUBLISHER, body: { event: 'approve' } }))
+    expect(res.status).toBe(200)
+    expect((await getCurrentEvent(env.CATALOG_DB, id))!.status).toBe('approved')
+  })
+
+  it('lets a contributor edit its OWN event metadata but not approve it', async () => {
+    const { env } = setupEnv()
+    const id = (await insertCurrentEvent(env.CATALOG_DB, { ...SAMPLE, ownerId: CONTRIBUTOR.id })).id
+    await upsertEventDatasetLink(env.CATALOG_DB, { eventId: id, datasetId: DS_0, matchScore: 0.9 })
+    // Edits-only submit (no decision) → allowed.
+    const edit = await reviewPost(
+      ctx({ env, id, publisher: CONTRIBUTOR, body: { edits: { occurredStart: '2026-06-26T00:00:00Z' } } }),
+    )
+    expect(edit.status).toBe(200)
+    // A decision → refused (no publish.own).
+    const approve = await reviewPost(ctx({ env, id, publisher: CONTRIBUTOR, body: { event: 'approve' } }))
+    expect(approve.status).toBe(403)
+    expect((JSON.parse(await approve.text()) as { error: string }).error).toBe('forbidden_role')
+  })
+
+  it('403 forbidden_owner when an author reviews an event owned by someone else', async () => {
+    const { env } = setupEnv()
+    // Seed an event already owned by the admin.
+    const id = (await insertCurrentEvent(env.CATALOG_DB, { ...SAMPLE, ownerId: 'PUB-ADMIN' })).id
+    await upsertEventDatasetLink(env.CATALOG_DB, { eventId: id, datasetId: DS_0, matchScore: 0.9 })
+    const res = await reviewPost(ctx({ env, id, publisher: PUBLISHER, body: { event: 'approve' } }))
+    expect(res.status).toBe(403)
+    expect((JSON.parse(await res.text()) as { error: string }).error).toBe('forbidden_owner')
+  })
+
+  it('does not transfer ownership when a different owner-or-admin re-reviews', async () => {
+    const { env } = setupEnv()
+    // Event already owned by the publisher; an admin re-review must not steal it.
+    const id = (await insertCurrentEvent(env.CATALOG_DB, { ...SAMPLE, ownerId: PUBLISHER.id })).id
+    await upsertEventDatasetLink(env.CATALOG_DB, { eventId: id, datasetId: DS_0, matchScore: 0.9 })
+    const res = await reviewPost(ctx({ env, id, body: { event: 'approve' } })) // ctx defaults to ADMIN
+    expect(res.status).toBe(200)
+    const row = await getCurrentEvent(env.CATALOG_DB, id)
+    expect(row!.owner_id).toBe(PUBLISHER.id) // unchanged
   })
 
   it('404 for an unknown event', async () => {
diff --git a/functions/api/v1/publish/events/[id].ts b/functions/api/v1/publish/events/[id].ts
index fc6c6d75c..88f290b1e 100644
--- a/functions/api/v1/publish/events/[id].ts
+++ b/functions/api/v1/publish/events/[id].ts
@@ -39,9 +39,11 @@
 
 import type { CatalogEnv } from '../../_lib/env'
 import type { PublisherData } from '../_middleware'
-import { isPrivileged } from '../../_lib/publisher-store'
 import { writeAuditEvent } from '../../_lib/audit-store'
 import {
+  canMutateEvent,
+  canReviewEvent,
+  claimEventOwner,
   getCurrentEvent,
   listLinksForEvent,
   getEventDecorations,
@@ -238,9 +240,6 @@ export const onRequestPost: PagesFunction<CatalogEnv, 'id'> = async context => {
     return jsonError(503, 'binding_missing', 'CATALOG_DB binding is not configured on this deployment.')
   }
   const publisher = (context.data as unknown as PublisherData).publisher
-  if (!isPrivileged(publisher)) {
-    return jsonError(403, 'forbidden_role', 'Reviewing events is restricted to admin and service callers.')
-  }
 
   const idParam = context.params.id
   const id = Array.isArray(idParam) ? idParam[0] : idParam
@@ -260,6 +259,21 @@ export const onRequestPost: PagesFunction<CatalogEnv, 'id'> = async context => {
   const event = await getCurrentEvent(db, id)
   if (!event) return jsonError(404, 'not_found', `Event ${id} not found.`)
 
+  // Two-tier write gate (decision D1). Baseline: the caller must be able
+  // to *edit* this event at all (its owner with edit.own, or an editor
+  // with edit.any). Additionally, any approve/reject decision — on the
+  // event itself or its dataset links — is a *publish* action, so it
+  // needs a publishing role. A contributor may correct its own event's
+  // metadata (edits-only submit) but cannot approve it; approving an
+  // unclaimed feed event requires content.publish.any (editor/admin).
+  if (!canMutateEvent(publisher, event)) {
+    return jsonError(403, 'forbidden_owner', 'You can only edit events you own.')
+  }
+  const hasDecision = parsed.value.event != null || parsed.value.links.length > 0
+  if (hasDecision && !canReviewEvent(publisher, event)) {
+    return jsonError(403, 'forbidden_role', 'Approving or rejecting an event requires a publishing role.')
+  }
+
   // Apply metadata corrections before anything else, so a same-submit
   // approve acts on the corrected event, and re-run the matcher so the
   // T/Ti/G signals score against the curator's values (statuses are
@@ -321,6 +335,11 @@ export const onRequestPost: PagesFunction<CatalogEnv, 'id'> = async context => {
 
   if (parsed.value.event) {
     await setEventStatus(db, id, DECISION_TO_STATUS[parsed.value.event], publisher.id)
+    // Approving an unclaimed event claims it for the approver (no-op if
+    // it already has an owner). Reject never assigns ownership.
+    if (parsed.value.event === 'approve') {
+      await claimEventOwner(db, id, publisher.id)
+    }
   }
   for (const link of parsed.value.links) {
     await setLinkStatus(db, id, link.datasetId, DECISION_TO_STATUS[link.decision], publisher.id)
@@ -351,7 +370,9 @@ export const onRequestPost: PagesFunction<CatalogEnv, 'id'> = async context => {
   const links = await listLinksForEvent(db, id)
   return new Response(
     JSON.stringify({
-      event: updated ? toPublicEvent(updated, decorations) : null,
+      event: updated
+        ? { ...toPublicEvent(updated, decorations), can_edit: canMutateEvent(publisher, updated) }
+        : null,
       links: links.map(l => ({
         datasetId: l.dataset_id,
         score: l.match_score,
diff --git a/functions/api/v1/publish/events/[id]/image.test.ts b/functions/api/v1/publish/events/[id]/image.test.ts
index ddefcda8c..41394ea01 100644
--- a/functions/api/v1/publish/events/[id]/image.test.ts
+++ b/functions/api/v1/publish/events/[id]/image.test.ts
@@ -42,6 +42,15 @@ function makeBucket() {
 
 function setupEnv() {
   const sqlite = seedFixtures({ count: 0 })
+  // Seed publisher rows so an event's owner_id FK resolves.
+  for (const p of [ADMIN, PUBLISHER]) {
+    sqlite
+      .prepare(
+        `INSERT INTO publishers (id, email, display_name, role, is_admin, status, created_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?)`,
+      )
+      .run(p.id, p.email, p.display_name, p.role, p.is_admin, p.status, p.created_at)
+  }
   const { bucket, puts } = makeBucket()
   const env = { CATALOG_DB: asD1(sqlite), CATALOG_R2: bucket, MOCK_R2: 'true' }
   return { sqlite, env, puts }
@@ -81,11 +90,12 @@ const toB64 = (bytes: Uint8Array): string => Buffer.from(bytes).toString('base64
 const PNG_BODY = { contentType: 'image/png', dataBase64: toB64(pngBytes()) }
 
 describe('POST /api/v1/publish/events/:id/image', () => {
-  it('is 403 for a publisher-role account', async () => {
+  it('is 403 forbidden_owner when a publisher targets an event owned by someone else', async () => {
     const { env } = setupEnv()
-    const id = (await insertCurrentEvent(env.CATALOG_DB, SAMPLE)).id
+    const id = (await insertCurrentEvent(env.CATALOG_DB, { ...SAMPLE, ownerId: 'PUB-ADMIN' })).id
     const res = await imagePost(ctx({ env, id, publisher: PUBLISHER, body: PNG_BODY }))
     expect(res.status).toBe(403)
+    expect((JSON.parse(await res.text()) as { error: string }).error).toBe('forbidden_owner')
   })
 
   it('is 404 for an unknown event', async () => {
diff --git a/functions/api/v1/publish/events/[id]/image.ts b/functions/api/v1/publish/events/[id]/image.ts
index 9769669cf..245995df2 100644
--- a/functions/api/v1/publish/events/[id]/image.ts
+++ b/functions/api/v1/publish/events/[id]/image.ts
@@ -25,11 +25,10 @@
 
 import type { CatalogEnv } from '../../../_lib/env'
 import type { PublisherData } from '../../_middleware'
-import { isPrivileged } from '../../../_lib/publisher-store'
 import { writeAuditEvent } from '../../../_lib/audit-store'
 import { sha256Hex, validateImagePayload } from '../../../_lib/image-upload'
 import { isR2PublicConfigured, resolveHttpAssetUrl } from '../../../_lib/r2-public-url'
-import { applyEventEdits, bustFeaturedEventCache, getCurrentEvent } from '../../../_lib/events-store'
+import { applyEventEdits, bustFeaturedEventCache, canMutateEvent, getCurrentEvent } from '../../../_lib/events-store'
 
 const CONTENT_TYPE = 'application/json; charset=utf-8'
 
@@ -55,9 +54,6 @@ export const onRequestPost: PagesFunction<CatalogEnv, 'id'> = async context => {
     return jsonError(503, 'r2_unconfigured', 'R2 public reads are not configured on this deployment.')
   }
   const publisher = (context.data as unknown as PublisherData).publisher
-  if (!isPrivileged(publisher)) {
-    return jsonError(403, 'forbidden_role', 'Uploading event images is restricted to admin and service callers.')
-  }
 
   const idParam = context.params.id
   const id = Array.isArray(idParam) ? idParam[0] : idParam
@@ -66,6 +62,12 @@ export const onRequestPost: PagesFunction<CatalogEnv, 'id'> = async context => {
   const db = context.env.CATALOG_DB
   const event = await getCurrentEvent(db, id)
   if (!event) return jsonError(404, 'not_found', `Event ${id} not found.`)
+  // Owner-scoped write: the owner writes via content.edit.own; an
+  // unclaimed event (owner_id null) requires content.edit.any
+  // (editor/admin/service). See canMutateEvent.
+  if (!canMutateEvent(publisher, event)) {
+    return jsonError(403, 'forbidden_owner', 'You can only edit events you own.')
+  }
 
   let body: { contentType?: unknown; dataBase64?: unknown; altText?: unknown }
   try {
diff --git a/functions/api/v1/publish/events/[id]/tour.test.ts b/functions/api/v1/publish/events/[id]/tour.test.ts
index 11f84f2ba..a02fc9d6d 100644
--- a/functions/api/v1/publish/events/[id]/tour.test.ts
+++ b/functions/api/v1/publish/events/[id]/tour.test.ts
@@ -2,7 +2,7 @@
  * Wire-level tests for POST /api/v1/publish/events/:id/tour — the
  * generate-a-tour-draft action.
  *
- * Coverage: privileged gate (403), 404 unknown event, 400 when no
+ * Coverage: owner-scoped write gate, 404 unknown event, 400 when no
  * visible dataset pairings exist, the approved-links-beat-proposed
  * stop selection, the happy path (201, D1 tour row, R2 draft blob
  * whose tasks include the event's flyTo/setTime/captions), template
@@ -105,11 +105,12 @@ async function readJson<T>(res: Response): Promise<T> {
 }
 
 describe('POST /api/v1/publish/events/:id/tour', () => {
-  it('403 for a publisher-role account', async () => {
+  it('403 forbidden_owner when a publisher targets an event owned by someone else', async () => {
     const { env } = setupEnv()
-    const id = (await insertCurrentEvent(env.CATALOG_DB, SAMPLE)).id
+    const id = (await insertCurrentEvent(env.CATALOG_DB, { ...SAMPLE, ownerId: 'PUB-ADMIN' })).id
     const res = await tourPost(ctx({ env, id, publisher: PUBLISHER }))
     expect(res.status).toBe(403)
+    expect((JSON.parse(await res.text()) as { error: string }).error).toBe('forbidden_owner')
   })
 
   it('404 for an unknown event', async () => {
diff --git a/functions/api/v1/publish/events/[id]/tour.ts b/functions/api/v1/publish/events/[id]/tour.ts
index ebb9e1d50..44e6311ea 100644
--- a/functions/api/v1/publish/events/[id]/tour.ts
+++ b/functions/api/v1/publish/events/[id]/tour.ts
@@ -20,9 +20,8 @@ import type { CatalogEnv } from '../../../_lib/env'
 import type { EnrichEnv } from '../../../_lib/events-enrich'
 import type { PublisherData } from '../../_middleware'
 import { getEffectiveFeatures } from '../../../_lib/node-settings-store'
-import { isPrivileged } from '../../../_lib/publisher-store'
 import { writeAuditEvent } from '../../../_lib/audit-store'
-import { getCurrentEvent, listLinksForEvent } from '../../../_lib/events-store'
+import { canMutateEvent, getCurrentEvent, listLinksForEvent } from '../../../_lib/events-store'
 import { resolveHttpAssetUrl } from '../../../_lib/r2-public-url'
 import { createDraftTour, writeTourDraftJson } from '../../../_lib/tour-mutations'
 import {
@@ -100,9 +99,6 @@ export const onRequestPost: PagesFunction<CatalogEnv & EnrichEnv, 'id'> = async
     return jsonError(503, 'binding_missing', 'CATALOG_DB binding is not configured on this deployment.')
   }
   const publisher = (context.data as unknown as PublisherData).publisher
-  if (!isPrivileged(publisher)) {
-    return jsonError(403, 'forbidden_role', 'Generating event tours is restricted to admin and service callers.')
-  }
 
   // Cross-feature coupling: the middleware gates this path on `events`
   // (its prefix), but the handler CREATES a tour draft — that needs
@@ -125,6 +121,12 @@ export const onRequestPost: PagesFunction<CatalogEnv & EnrichEnv, 'id'> = async
   const db = context.env.CATALOG_DB
   const event = await getCurrentEvent(db, id)
   if (!event) return jsonError(404, 'not_found', `Event ${id} not found.`)
+  // Owner-scoped write: the owner writes via content.edit.own; an
+  // unclaimed event (owner_id null) requires content.edit.any
+  // (editor/admin/service). See canMutateEvent.
+  if (!canMutateEvent(publisher, event)) {
+    return jsonError(403, 'forbidden_owner', 'You can only build tours for events you own.')
+  }
 
   const datasets = await resolveStopDatasets(db, id, ref => resolveHttpAssetUrl(context.env, ref))
   if (datasets.length === 0) {
diff --git a/functions/api/v1/publish/featured-hero.test.ts b/functions/api/v1/publish/featured-hero.test.ts
index bca03f016..1c3d3738d 100644
--- a/functions/api/v1/publish/featured-hero.test.ts
+++ b/functions/api/v1/publish/featured-hero.test.ts
@@ -30,7 +30,8 @@ const ADMIN: PublisherRow = {
   status: 'active',
   created_at: '2026-01-01T00:00:00.000Z',
 }
-const PUBLISHER: PublisherRow = { ...ADMIN, id: 'PUB-PUBLISHER', email: 'c@e', role: 'publisher', is_admin: 0 }
+const PUBLISHER: PublisherRow = { ...ADMIN, id: 'PUB-PUBLISHER', email: 'c@e', role: 'author', is_admin: 0 }
+const EDITOR: PublisherRow = { ...ADMIN, id: 'PUB-EDITOR', email: 'ed@e', role: 'editor', is_admin: 0 }
 
 const DS_0 = 'DS000' + 'A'.repeat(21)
 const DS_1 = 'DS001' + 'A'.repeat(21)
@@ -39,7 +40,7 @@ const WINDOW = { start: '2026-05-01T00:00:00.000Z', end: '2026-06-01T00:00:00.00
 
 function setupEnv() {
   const sqlite = seedFixtures({ count: 2 })
-  for (const p of [ADMIN, PUBLISHER]) {
+  for (const p of [ADMIN, PUBLISHER, EDITOR]) {
     sqlite
       .prepare(
         `INSERT INTO publishers (id, email, display_name, role, is_admin, status, created_at)
@@ -80,12 +81,18 @@ function auditCount(sqlite: ReturnType<typeof seedFixtures>, action: string): nu
 }
 
 describe('PUT /api/v1/publish/featured-hero', () => {
-  it('403 for a publisher-role account', async () => {
+  it('403 for an author-role account (lacks hero.manage)', async () => {
     const { env } = setupEnv()
     const res = await heroPut(ctx({ env, publisher: PUBLISHER, body: { dataset_id: DS_0, window: WINDOW } }))
     expect(res.status).toBe(403)
   })
 
+  it('lets an editor set the hero (hero.manage)', async () => {
+    const { env } = setupEnv()
+    const res = await heroPut(ctx({ env, publisher: EDITOR, body: { dataset_id: DS_0, window: WINDOW } }))
+    expect(res.status).toBe(200)
+  })
+
   it('400 for a missing window', async () => {
     const { env } = setupEnv()
     const res = await heroPut(ctx({ env, body: { dataset_id: DS_0 } }))
diff --git a/functions/api/v1/publish/featured-hero.ts b/functions/api/v1/publish/featured-hero.ts
index a38cfcad7..1f98c168c 100644
--- a/functions/api/v1/publish/featured-hero.ts
+++ b/functions/api/v1/publish/featured-hero.ts
@@ -30,7 +30,7 @@ import {
   toPublicHero,
   validateHeroInput,
 } from '../_lib/hero-override-store'
-import { isPrivileged } from '../_lib/publisher-store'
+import { can } from '../_lib/capabilities'
 import { writeAuditEvent } from '../_lib/audit-store'
 
 const CONTENT_TYPE = 'application/json; charset=utf-8'
@@ -46,7 +46,7 @@ function forbidden(): Response {
   return jsonError(
     403,
     'forbidden_role',
-    'Hero override is restricted to staff, admin, and service callers.',
+    'Setting the hero requires the editor, admin, or service role.',
   )
 }
 
@@ -55,7 +55,7 @@ export const onRequestPut: PagesFunction<CatalogEnv> = async context => {
     return jsonError(503, 'binding_missing', 'CATALOG_DB binding is not configured on this deployment.')
   }
   const publisher = (context.data as unknown as PublisherData).publisher
-  if (!isPrivileged(publisher)) return forbidden()
+  if (!can(publisher, 'hero.manage')) return forbidden()
 
   let body: unknown
   try {
@@ -105,7 +105,7 @@ export const onRequestDelete: PagesFunction<CatalogEnv> = async context => {
     return jsonError(503, 'binding_missing', 'CATALOG_DB binding is not configured on this deployment.')
   }
   const publisher = (context.data as unknown as PublisherData).publisher
-  if (!isPrivileged(publisher)) return forbidden()
+  if (!can(publisher, 'hero.manage')) return forbidden()
 
   // Read the existing pin (if any) so the audit row records which
   // dataset was un-pinned. Clear is idempotent regardless.
diff --git a/functions/api/v1/publish/feedback.test.ts b/functions/api/v1/publish/feedback.test.ts
index afcd9d33e..a4571ce6a 100644
--- a/functions/api/v1/publish/feedback.test.ts
+++ b/functions/api/v1/publish/feedback.test.ts
@@ -98,10 +98,14 @@ function ctx(opts: { env: Record<string, unknown>; publisher?: PublisherRow; que
 }
 
 describe('GET /api/v1/publish/feedback', () => {
-  it('503s without FEEDBACK_DB and 403s for publisher-role callers', async () => {
-    const { env } = setup()
+  it('503s without FEEDBACK_DB', async () => {
     expect((await feedbackGet(ctx({ env: {}, query: '?view=ai' }))).status).toBe(503)
-    expect((await feedbackGet(ctx({ env, publisher: PUBLISHER, query: '?view=ai' }))).status).toBe(403)
+  })
+
+  it('is readable by a non-privileged (publisher-role) caller — read-only view access', async () => {
+    const { env } = setup()
+    const res = await feedbackGet(ctx({ env, publisher: PUBLISHER, query: '?view=ai' }))
+    expect(res.status).toBe(200)
   })
 
   it('400s on a missing or unknown view', async () => {
diff --git a/functions/api/v1/publish/feedback.ts b/functions/api/v1/publish/feedback.ts
index 79c9975d4..d886c9d92 100644
--- a/functions/api/v1/publish/feedback.ts
+++ b/functions/api/v1/publish/feedback.ts
@@ -3,11 +3,11 @@
  * `/publish/feedback` portal tab (Phase C of
  * `docs/ANALYTICS_STORAGE_AND_ADMIN_PLAN.md`).
  *
- * A thin privilege-gated facade over the same `_feedback-helpers`
+ * A thin read-only facade over the same `_feedback-helpers`
  * the legacy `/api/feedback-admin` endpoint uses — one data layer,
- * two auth surfaces (this one rides the publish middleware +
- * `isPrivileged()`; feedback-admin keeps Cloudflare Access /
- * bearer-token for scripts). Views:
+ * two auth surfaces (this one rides the publish middleware and is
+ * readable by any active publisher; feedback-admin keeps Cloudflare
+ * Access / bearer-token for scripts). Views:
  *
  *   ?view=ai&days=30&recent=100         → AI thumbs dashboard JSON
  *   ?view=general&days=30&recent=100    → bug/feature/other JSON
@@ -23,13 +23,11 @@
  */
 
 import type { CatalogEnv } from '../_lib/env'
-import type { PublisherData } from './_middleware'
 import {
   fetchAiDashboard,
   fetchGeneralDashboard,
   fetchScreenshot,
 } from '../../_feedback-helpers'
-import { isPrivileged } from '../_lib/publisher-store'
 
 const CONTENT_TYPE = 'application/json; charset=utf-8'
 const ALLOWED_VIEWS = ['ai', 'general', 'screenshot'] as const
@@ -56,11 +54,9 @@ export const onRequestGet: PagesFunction<CatalogEnv> = async context => {
   if (!context.env.FEEDBACK_DB) {
     return jsonError(503, 'binding_missing', 'FEEDBACK_DB binding is not configured on this deployment.')
   }
-  const publisher = (context.data as unknown as PublisherData).publisher
-  if (!isPrivileged(publisher)) {
-    return jsonError(403, 'forbidden_role', 'Feedback review is restricted to admin and service callers.')
-  }
-
+  // Read-only view is open to any active publisher (the middleware
+  // has already rejected pending / suspended accounts). There are no
+  // mutation routes under this path — the page only reads.
   const params = new URL(context.request.url).searchParams
   const view = params.get('view') ?? ''
   if (!(ALLOWED_VIEWS as readonly string[]).includes(view)) {
diff --git a/functions/api/v1/publish/me.ts b/functions/api/v1/publish/me.ts
index 47d298f8f..bd4c63052 100644
--- a/functions/api/v1/publish/me.ts
+++ b/functions/api/v1/publish/me.ts
@@ -9,6 +9,7 @@
 
 import type { CatalogEnv } from '../_lib/env'
 import type { PublisherData } from './_middleware'
+import { capabilitiesForRole } from '../../../../src/types/publisher-roles'
 
 const CONTENT_TYPE = 'application/json; charset=utf-8'
 
@@ -24,6 +25,9 @@ export const onRequestGet: PagesFunction<CatalogEnv> = async context => {
       is_admin: publisher.is_admin === 1,
       status: publisher.status,
       created_at: publisher.created_at,
+      // The caller's resolved capability list — the portal gates its
+      // controls on these rather than re-deriving from `role`.
+      capabilities: capabilitiesForRole(publisher.role),
     }),
     {
       status: 200,
diff --git a/functions/api/v1/publish/publishers.test.ts b/functions/api/v1/publish/publishers.test.ts
index d95751812..3debd552e 100644
--- a/functions/api/v1/publish/publishers.test.ts
+++ b/functions/api/v1/publish/publishers.test.ts
@@ -174,7 +174,7 @@ describe('PATCH /api/v1/publish/publishers/{id}', () => {
     const other = { ...ADMIN, id: 'PUB-OTHER', email: 'o@e' }
     const { env } = setupEnv([ADMIN, other])
     const res = await detailPatch(
-      ctx({ env, method: 'PATCH', params: { id: 'PUB-ADMIN' }, body: { role: 'publisher' } }),
+      ctx({ env, method: 'PATCH', params: { id: 'PUB-ADMIN' }, body: { role: 'author' } }),
     )
     expect(res.status).toBe(409)
     expect((await readJson<{ error: string }>(res)).error).toBe('self_lockout')
@@ -184,7 +184,7 @@ describe('PATCH /api/v1/publish/publishers/{id}', () => {
     const { env } = setupEnv([ADMIN])
     const ghost = { ...ADMIN, id: 'PUB-GHOST' }
     const res = await detailPatch(
-      ctx({ env, publisher: ghost, method: 'PATCH', params: { id: 'PUB-ADMIN' }, body: { role: 'publisher' } }),
+      ctx({ env, publisher: ghost, method: 'PATCH', params: { id: 'PUB-ADMIN' }, body: { role: 'author' } }),
     )
     expect(res.status).toBe(409)
     expect((await readJson<{ error: string }>(res)).error).toBe('last_admin')
diff --git a/functions/api/v1/publish/tours.ts b/functions/api/v1/publish/tours.ts
index 39af5c915..4cead4e87 100644
--- a/functions/api/v1/publish/tours.ts
+++ b/functions/api/v1/publish/tours.ts
@@ -19,6 +19,7 @@ import type { CatalogEnv } from '../_lib/env'
 import type { PublisherData } from './_middleware'
 import { getNodeIdentity } from '../_lib/catalog-store'
 import { createTour, listToursForPublisher } from '../_lib/tour-mutations'
+import { can } from '../_lib/capabilities'
 
 const CONTENT_TYPE = 'application/json; charset=utf-8'
 const DEFAULT_LIMIT = 50
@@ -59,6 +60,9 @@ export const onRequestGet: PagesFunction<CatalogEnv> = async context => {
 
 export const onRequestPost: PagesFunction<CatalogEnv> = async context => {
   const publisher = (context.data as unknown as PublisherData).publisher
+  if (!can(publisher, 'content.create')) {
+    return jsonError(403, 'forbidden_role', 'Creating tours requires an authoring role.')
+  }
   // See publish/datasets.ts — the createTour SQL embeds the
   // node_identity row id as `origin_node`, so a fresh deploy that
   // hasn't run `gen:node-key` would crash with a NOT NULL error.
diff --git a/functions/api/v1/publish/tours/[id]/publish.ts b/functions/api/v1/publish/tours/[id]/publish.ts
index b1181a5f5..f7c6af5b2 100644
--- a/functions/api/v1/publish/tours/[id]/publish.ts
+++ b/functions/api/v1/publish/tours/[id]/publish.ts
@@ -25,7 +25,8 @@
 
 import type { CatalogEnv } from '../../../_lib/env'
 import type { PublisherData } from '../../_middleware'
-import { publishTour } from '../../../_lib/tour-mutations'
+import { getTourForPublisher, publishTour } from '../../../_lib/tour-mutations'
+import { canOwnOrAny } from '../../../_lib/capabilities'
 
 const CONTENT_TYPE = 'application/json; charset=utf-8'
 
@@ -45,6 +46,15 @@ export const onRequestPost: PagesFunction<CatalogEnv, 'id'> = async context => {
   const publisher = (context.data as unknown as PublisherData).publisher
   const id = pickId(context.params.id)
   if (!id) return jsonError(400, 'invalid_request', 'Missing tour id.')
+  // Publishing is a privilege above authoring: a contributor may create
+  // + edit its own draft tour but cannot make it public. Gate on the
+  // publish capability against the tour's owner (author-own or
+  // editor/admin-any), mirroring datasets/blog.
+  const existing = await getTourForPublisher(context.env.CATALOG_DB!, publisher, id)
+  if (!existing) return jsonError(404, 'not_found', `Tour ${id} not found.`)
+  if (!canOwnOrAny(publisher, existing.publisher_id, 'content.publish.own', 'content.publish.any')) {
+    return jsonError(403, 'forbidden_role', 'Publishing a tour requires a publishing role.')
+  }
   const result = await publishTour(context.env, publisher, id)
   if (!result.ok) return jsonError(result.status, result.error, result.message)
   return new Response(
diff --git a/functions/api/v1/publish/tours/[id]/retract.ts b/functions/api/v1/publish/tours/[id]/retract.ts
index f1a2df352..2cd22d9b0 100644
--- a/functions/api/v1/publish/tours/[id]/retract.ts
+++ b/functions/api/v1/publish/tours/[id]/retract.ts
@@ -25,7 +25,8 @@
 
 import type { CatalogEnv } from '../../../_lib/env'
 import type { PublisherData } from '../../_middleware'
-import { retractTour } from '../../../_lib/tour-mutations'
+import { getTourForPublisher, retractTour } from '../../../_lib/tour-mutations'
+import { canOwnOrAny } from '../../../_lib/capabilities'
 
 const CONTENT_TYPE = 'application/json; charset=utf-8'
 
@@ -45,6 +46,13 @@ export const onRequestPost: PagesFunction<CatalogEnv, 'id'> = async context => {
   const publisher = (context.data as unknown as PublisherData).publisher
   const id = pickId(context.params.id)
   if (!id) return jsonError(400, 'invalid_request', 'Missing tour id.')
+  // Retract is a publish-tier action (changes public visibility) — same
+  // gate as publish.
+  const existing = await getTourForPublisher(context.env.CATALOG_DB!, publisher, id)
+  if (!existing) return jsonError(404, 'not_found', `Tour ${id} not found.`)
+  if (!canOwnOrAny(publisher, existing.publisher_id, 'content.publish.own', 'content.publish.any')) {
+    return jsonError(403, 'forbidden_role', 'Retracting a tour requires a publishing role.')
+  }
   const result = await retractTour(context.env, publisher, id)
   if (!result.ok) return jsonError(result.status, result.error, result.message)
   return new Response(JSON.stringify({ tour: result.tour }), {
diff --git a/functions/api/v1/publish/tours/draft.test.ts b/functions/api/v1/publish/tours/draft.test.ts
index 2bf9444b5..2760a688b 100644
--- a/functions/api/v1/publish/tours/draft.test.ts
+++ b/functions/api/v1/publish/tours/draft.test.ts
@@ -74,7 +74,9 @@ function setupEnv() {
   }
 }
 
-function ctx(opts: { env: Record<string, unknown>; body?: unknown }) {
+const REVIEWER: PublisherRow = { ...ADMIN, id: 'PUB-REVIEWER', email: 'r@e', role: 'reviewer', is_admin: 0 }
+
+function ctx(opts: { env: Record<string, unknown>; body?: unknown; publisher?: PublisherRow }) {
   const url = 'https://localhost/api/v1/publish/tours/draft'
   const headers = new Headers()
   if (opts.body !== undefined) headers.set('Content-Type', 'application/json')
@@ -84,7 +86,7 @@ function ctx(opts: { env: Record<string, unknown>; body?: unknown }) {
     request: new Request(url, init),
     env: opts.env,
     params: {} as Record<string, never>,
-    data: { publisher: ADMIN },
+    data: { publisher: opts.publisher ?? ADMIN },
     waitUntil: () => {},
     passThroughOnException: () => {},
     next: async () => new Response(null),
@@ -97,6 +99,13 @@ async function readJson<T>(res: Response): Promise<T> {
 }
 
 describe('POST /api/v1/publish/tours/draft (tour/E)', () => {
+  it('403s for a read-only reviewer (needs content.create) — no tour authoring bypass', async () => {
+    const { env } = setupEnv()
+    const res = await onRequestPost(ctx({ env, body: { title: 'Nope' }, publisher: REVIEWER }))
+    expect(res.status).toBe(403)
+    expect((await readJson<{ error: string }>(res)).error).toBe('forbidden_role')
+  })
+
   it('mints a row + seeds an empty TourFile in R2', async () => {
     const { env, bucket, sqlite } = setupEnv()
     const res = await onRequestPost(ctx({ env }))
diff --git a/functions/api/v1/publish/tours/draft.ts b/functions/api/v1/publish/tours/draft.ts
index 454dedf9a..9733d4d36 100644
--- a/functions/api/v1/publish/tours/draft.ts
+++ b/functions/api/v1/publish/tours/draft.ts
@@ -47,6 +47,7 @@
 import type { CatalogEnv } from '../../_lib/env'
 import type { PublisherData } from '../_middleware'
 import { createDraftTour } from '../../_lib/tour-mutations'
+import { can } from '../../_lib/capabilities'
 
 const CONTENT_TYPE = 'application/json; charset=utf-8'
 
@@ -59,6 +60,13 @@ function jsonError(status: number, error: string, message: string): Response {
 
 export const onRequestPost: PagesFunction<CatalogEnv> = async context => {
   const publisher = (context.data as unknown as PublisherData).publisher
+  // Creating a draft tour requires an authoring role — a read-only
+  // reviewer is refused (mirrors the tours.ts / datasets.ts create gate;
+  // without this a reviewer could mint a tour it owns and then author +
+  // publish it through the ownership-gated tour routes).
+  if (!can(publisher, 'content.create')) {
+    return jsonError(403, 'forbidden_role', 'Creating tours requires an authoring role.')
+  }
   let body: { title?: string } = {}
   const text = await context.request.text()
   if (text) {
diff --git a/locales/_explanations.json b/locales/_explanations.json
index 9e4d8fda9..e3a23f393 100644
--- a/locales/_explanations.json
+++ b/locales/_explanations.json
@@ -209,8 +209,6 @@
   "publisher.me.heading": "H2 heading at the top of the publisher profile card (/publish/me). Internal context: only the publisher viewing it sees this string.",
   "publisher.me.loading": "Live-region status text shown while the profile fetch is in flight. Should imply work-in-progress, brief.",
   "publisher.me.role.admin": "Role badge text for admin publishers — full administrative authority over the deploying node's catalog, including approving and managing other publishers. Keep short — fits inside a badge.",
-  "publisher.me.role.publisher": "Role badge text for publisher accounts — the secondary authoring role that can publish and edit its own datasets but not manage other users. Keep short — fits inside a badge.",
-  "publisher.me.role.readonly": "Role badge text for read-only publishers (auditors, assigned reviewers without write access). Keep short — fits inside a badge.",
   "publisher.me.role.service": "Role badge text for non-interactive service accounts (CI pipelines, scheduled jobs using a Cloudflare Access service token). Keep short.",
   "publisher.me.status.active": "Status badge text for an active publisher (can publish, edit, retract). Keep short — fits inside a badge.",
   "publisher.me.status.pending": "Status badge text for a publisher account whose row exists but hasn't been approved yet (publisher accounts default to this; an admin approves them in the portal's Users tab). 'Pending approval' is two words — keep it tight.",
diff --git a/locales/en.json b/locales/en.json
index 627d90235..9c850adce 100644
--- a/locales/en.json
+++ b/locales/en.json
@@ -627,7 +627,6 @@
   "publisher.analytics.research.tour": "Tour",
   "publisher.analytics.research.worstQuestions": "Worst-answered quiz questions",
   "publisher.analytics.research.zeroSearches": "Zero-result searches (hashed)",
-  "publisher.analytics.restricted": "This feature is restricted to staff members.",
   "publisher.analytics.section.datasets": "Dataset engagement",
   "publisher.analytics.section.funnel": "Tours, VR & Orbit",
   "publisher.analytics.section.orbit": "Orbit usage",
@@ -765,7 +764,7 @@
   "publisher.blog.picker.searchPlaceholder": "Search published datasets…",
   "publisher.blog.publish": "Publish",
   "publisher.blog.published": "Published — live at /blog/{slug}.",
-  "publisher.blog.restricted": "Blog authoring is restricted to admin publishers.",
+  "publisher.blog.readonly.notice": "You have view-only access to this post — only its author can edit it.",
   "publisher.blog.save": "Save draft",
   "publisher.blog.saved": "Saved.",
   "publisher.blog.status.draft": "Draft",
@@ -960,6 +959,8 @@
   "publisher.datasets.action.edit.aria": "Edit dataset {title}",
   "publisher.datasets.action.retract": "Retract",
   "publisher.datasets.action.retract.aria": "Retract dataset {title}",
+  "publisher.datasets.action.view": "View",
+  "publisher.datasets.action.view.aria": "View dataset {title}",
   "publisher.datasets.col.actions": "Actions",
   "publisher.datasets.col.format": "Format",
   "publisher.datasets.col.slug": "Slug",
@@ -1064,12 +1065,12 @@
   "publisher.events.queue.rowAria": "{title}, {category}, {count} datasets to review",
   "publisher.events.queue.toReview": "{count} datasets to review",
   "publisher.events.queue.uncategorized": "uncategorized",
+  "publisher.events.readonly.notice": "You have view-only access to this event — only its owner can review or edit it.",
   "publisher.events.refresh": "Refresh feed",
   "publisher.events.refreshError": "Couldn't reach the feed. Please try again.",
   "publisher.events.refreshResult": "Imported {created} new · {refreshed} refreshed · {failed} skipped.",
   "publisher.events.refreshing": "Refreshing…",
   "publisher.events.reject": "Reject",
-  "publisher.events.restricted": "Reviewing events is restricted to admin publishers.",
   "publisher.events.saved": "Saved.",
   "publisher.events.signal.geo": "Geo",
   "publisher.events.signal.temporal": "Time",
@@ -1149,7 +1150,6 @@
   "publisher.feedback.general.screenshotLabel": "Screenshot",
   "publisher.feedback.general.total": "Total",
   "publisher.feedback.loading": "Loading feedback…",
-  "publisher.feedback.restricted": "This feature is restricted to staff members.",
   "publisher.feedback.subtitle": "What visitors tell you — Orbit's AI ratings and general bug reports.",
   "publisher.feedback.tab.ai": "AI feedback",
   "publisher.feedback.tab.general": "General feedback",
@@ -1244,7 +1244,11 @@
   "publisher.hero.loading": "Loading…",
   "publisher.hero.pickDataset": "Select a dataset…",
   "publisher.hero.preview": "Preview · catalog card",
-  "publisher.hero.restricted": "Setting the hero is restricted to staff and admin publishers.",
+  "publisher.hero.readonly.current": "Currently featured",
+  "publisher.hero.readonly.headline": "Headline: {headline}",
+  "publisher.hero.readonly.none": "No dataset is currently featured. The catalog falls back to an auto-derived real-time dataset.",
+  "publisher.hero.readonly.notice": "You have view-only access. Only editors and admins can change the featured hero.",
+  "publisher.hero.readonly.window": "Active {start} – {end}",
   "publisher.hero.saved": "Hero set.",
   "publisher.hero.set": "Set hero",
   "publisher.hero.title": "“Right now” hero",
@@ -1287,6 +1291,7 @@
   "publisher.import.preview.warning": "{count} warning",
   "publisher.import.remote.body": "Federated node-to-node import arrives with Phase 4 federation. You'll paste a remote node URL and choose which published datasets to pull in as drafts.",
   "publisher.import.remote.comingSoon": "Coming with federation",
+  "publisher.import.restricted": "Importing datasets needs a role that can create content (contributor, author, editor, or admin). Your reviewer role has read-only access — contact an admin if you need to import.",
   "publisher.import.status.error": "Error",
   "publisher.import.status.ready": "Ready",
   "publisher.import.status.warning": "Warning",
@@ -1337,8 +1342,10 @@
   "publisher.me.heading": "Your publisher profile",
   "publisher.me.loading": "Loading your profile…",
   "publisher.me.role.admin": "Admin",
-  "publisher.me.role.publisher": "Publisher",
-  "publisher.me.role.readonly": "Read-only",
+  "publisher.me.role.author": "Author",
+  "publisher.me.role.contributor": "Contributor",
+  "publisher.me.role.editor": "Editor",
+  "publisher.me.role.reviewer": "Reviewer",
   "publisher.me.role.service": "Service",
   "publisher.me.status.active": "Active",
   "publisher.me.status.pending": "Pending approval",
@@ -1482,7 +1489,20 @@
   "publisher.section.tours": "Tours",
   "publisher.team.invite": "Invite member",
   "publisher.team.inviteNote": "Members are provisioned through your identity provider on first sign-in.",
-  "publisher.team.rolesNote": "Admins manage the team, datasets, and settings. Publishers create and publish content. Service keys ingest data through the API.",
+  "publisher.team.roleGuide.cap.create": "Create drafts (datasets, events, blog, tours)",
+  "publisher.team.roleGuide.cap.editAny": "Edit & publish anyone's content",
+  "publisher.team.roleGuide.cap.editOwn": "Edit & delete their own content",
+  "publisher.team.roleGuide.cap.hero": "Set the “Right now” hero",
+  "publisher.team.roleGuide.cap.operator": "Manage feeds & node settings",
+  "publisher.team.roleGuide.cap.publishOwn": "Publish & retract their own content",
+  "publisher.team.roleGuide.cap.read": "Read the catalog, events & insights",
+  "publisher.team.roleGuide.cap.users": "Manage members & roles",
+  "publisher.team.roleGuide.capHeader": "Can",
+  "publisher.team.roleGuide.intro": "Each role can do everything the ones before it can, plus more. Reading is open to every active member; roles differ in what they can create, publish, and administer.",
+  "publisher.team.roleGuide.no": "No",
+  "publisher.team.roleGuide.title": "What each role can do",
+  "publisher.team.roleGuide.yes": "Yes",
+  "publisher.team.rolesNote": "Admins manage the team, datasets, and settings. Editors publish and edit any content; authors create and publish their own; contributors draft content for review; reviewers have read-only access. Service keys ingest data through the API.",
   "publisher.team.serviceKey": "Service key",
   "publisher.team.subtitle": "Manage who can publish to your node, and the service keys that ingest data.",
   "publisher.team.title": "Team",
diff --git a/migrations/catalog-schema.sql b/migrations/catalog-schema.sql
index cace5bb46..a5c16f800 100644
--- a/migrations/catalog-schema.sql
+++ b/migrations/catalog-schema.sql
@@ -207,7 +207,7 @@ CREATE TABLE current_events (
   -- column line so a later ALTER ADD COLUMN doesn't splice a new column
   -- after it and inherit this comment in the schema snapshot.)
   reviewed_at    TEXT,
-  reviewed_by    TEXT, external_id TEXT, inferred_fields TEXT, image_url TEXT, image_alt TEXT, video_embed_url TEXT,
+  reviewed_by    TEXT, external_id TEXT, inferred_fields TEXT, image_url TEXT, image_alt TEXT, video_embed_url TEXT, owner_id TEXT REFERENCES publishers(id),
   FOREIGN KEY (reviewed_by) REFERENCES publishers(id)
 );
 
@@ -553,6 +553,7 @@ CREATE UNIQUE INDEX idx_current_events_feed_external
   ON current_events(feed_id, external_id)
   WHERE feed_id IS NOT NULL AND external_id IS NOT NULL;
 CREATE INDEX idx_current_events_origin_node ON current_events(origin_node);
+CREATE INDEX idx_current_events_owner ON current_events(owner_id);
 CREATE INDEX idx_current_events_status      ON current_events(status, created_at);
 CREATE UNIQUE INDEX idx_datasets_legacy_id
   ON datasets(legacy_id)
diff --git a/migrations/catalog/0038_event_owner.sql b/migrations/catalog/0038_event_owner.sql
new file mode 100644
index 000000000..e7dc69d0e
--- /dev/null
+++ b/migrations/catalog/0038_event_owner.sql
@@ -0,0 +1,29 @@
+-- 0038_event_owner.sql — ownership for current events.
+--
+-- Publishers get the same "read all, write own" access to events that
+-- they have to datasets. Events, unlike datasets, are often machine-
+-- created by feed connectors (proposed, unowned), so ownership is
+-- assigned by action rather than at insert:
+--
+--   - A publisher who manually creates an event (the "+ New event"
+--     drawer) owns it immediately.
+--   - A publisher who approves an as-yet-unclaimed proposed event
+--     becomes its owner.
+--
+-- Write access is capability-gated (see `canMutateEvent` /
+-- `canReviewEvent`): the owner writes via `content.edit.own`, while an
+-- unclaimed event (owner_id IS NULL) requires `content.edit.any` to
+-- edit and `content.publish.any` to claim/review — i.e. editor / admin /
+-- service, not any active publisher. Read access is unconditional — the
+-- whole events queue is visible to every active publisher.
+--
+-- Distinct from `reviewed_by` (the last curator to act, set on every
+-- review including a reject): `owner_id` is the durable owner, set once
+-- and not overwritten by a later reviewer.
+--
+-- Additive only: one nullable column + a lookup index.
+
+ALTER TABLE current_events ADD COLUMN owner_id TEXT REFERENCES publishers(id);
+
+-- "Which events does this publisher own?" — the write-scope lookup.
+CREATE INDEX idx_current_events_owner ON current_events(owner_id);
diff --git a/migrations/catalog/0039_publisher_roles_five.sql b/migrations/catalog/0039_publisher_roles_five.sql
new file mode 100644
index 000000000..2eb78818f
--- /dev/null
+++ b/migrations/catalog/0039_publisher_roles_five.sql
@@ -0,0 +1,28 @@
+-- 0039_publisher_roles_five.sql — canonical five-role names.
+--
+-- Renames the two legacy publisher role strings to their canonical
+-- WordPress-style identifiers, as the data half of the role/capability
+-- model (docs/PUBLISHER_ROLES_PLAN.md):
+--
+--   publisher → author     (create + publish/edit OWN content)
+--   readonly  → reviewer    (read-only)
+--
+-- The two new roles introduced by the model — `editor` and
+-- `contributor` — need no backfill: no existing row holds them, and
+-- they are assigned going forward through the Users tab. `admin` and
+-- `service` are unchanged.
+--
+-- Follows the pattern of 0023_publisher_roles_two_tier.sql, which
+-- renamed staff/community → admin/publisher. The `role` column has no
+-- CHECK constraint (see 0005_publishers_audit.sql), so the enum is a
+-- runtime concern; this migration only rewrites stored values.
+--
+-- `is_admin` is the synced mirror of `role = 'admin'` and is unaffected
+-- (neither renamed role was ever admin). Application code accepts the
+-- legacy strings as aliases (normalizeRole) so a mid-deploy read of an
+-- un-migrated replica still resolves correctly.
+--
+-- Additive/idempotent: re-running is a no-op once values are canonical.
+
+UPDATE publishers SET role = 'author'   WHERE role = 'publisher';
+UPDATE publishers SET role = 'reviewer' WHERE role = 'readonly';
diff --git a/scripts/seed-catalog.test.ts b/scripts/seed-catalog.test.ts
index 2a3162a9d..ea899c648 100644
--- a/scripts/seed-catalog.test.ts
+++ b/scripts/seed-catalog.test.ts
@@ -82,6 +82,7 @@ const EXPECTED_INDEXES = [
   'idx_blog_posts_status',
   'idx_current_events_feed_external',
   'idx_current_events_origin_node',
+  'idx_current_events_owner',
   'idx_current_events_status',
   'idx_datasets_legacy_id',
   'idx_datasets_publisher',
diff --git a/src/styles/publisher.css b/src/styles/publisher.css
index d6e8fb93d..95aabae1e 100644
--- a/src/styles/publisher.css
+++ b/src/styles/publisher.css
@@ -4025,6 +4025,12 @@
   font-size: calc(0.9rem * var(--ui-scale));
 }
 
+.publisher-import-restricted {
+  margin-block-start: calc(1.5rem * var(--ui-scale));
+  color: var(--color-text-muted, #aab2c0);
+  font-size: calc(0.85rem * var(--ui-scale));
+}
+
 .publisher-import-methods {
   display: grid;
   grid-template-columns: repeat(auto-fit, minmax(calc(14rem * var(--ui-scale)), 1fr));
@@ -4466,6 +4472,36 @@
   font-size: calc(0.8rem * var(--ui-scale));
   color: var(--color-text-muted, #999999);
 }
+
+/* Role → capability reference (collapsible) on the Team tab. */
+.publisher-role-guide {
+  margin-block: calc(1rem * var(--ui-scale)) calc(1.25rem * var(--ui-scale));
+}
+.publisher-role-guide-summary {
+  cursor: pointer;
+  font-weight: 600;
+  font-size: calc(0.9rem * var(--ui-scale));
+  padding-block: calc(0.35rem * var(--ui-scale));
+}
+.publisher-role-guide-intro {
+  margin: calc(0.5rem * var(--ui-scale)) 0 calc(0.75rem * var(--ui-scale));
+  max-inline-size: calc(46rem * var(--ui-scale));
+  font-size: calc(0.8rem * var(--ui-scale));
+  color: var(--color-text-muted, #999999);
+}
+/* Role columns are narrow yes/no marks; the capability label carries the row. */
+.publisher-role-guide-table th:not(:first-child),
+.publisher-role-guide-cell {
+  text-align: center;
+}
+.publisher-role-guide-cell {
+  color: var(--color-text-muted, #999999);
+  font-size: calc(0.95rem * var(--ui-scale));
+}
+.publisher-role-guide-yes {
+  color: var(--color-accent, #4ea1ff);
+  font-weight: 700;
+}
 .publisher-users-identity {
   display: flex;
   align-items: center;
diff --git a/src/types/publisher-roles.test.ts b/src/types/publisher-roles.test.ts
new file mode 100644
index 000000000..7d54e392a
--- /dev/null
+++ b/src/types/publisher-roles.test.ts
@@ -0,0 +1,97 @@
+import { describe, expect, it } from 'vitest'
+import {
+  CAPABILITIES,
+  ROLES,
+  ROLE_CAPABILITIES,
+  type Capability,
+  type Role,
+  capabilitiesForRole,
+  normalizeRole,
+  roleCan,
+} from './publisher-roles'
+
+describe('publisher role → capability matrix', () => {
+  // The full truth table, asserted exhaustively so any cell change is a
+  // reviewed diff. `1` = granted. Legacy strings map via normalizeRole.
+  const MATRIX: Record<Role, Record<Capability, 0 | 1>> = {
+    admin: {
+      'content.read': 1, 'content.create': 1, 'content.edit.own': 1, 'content.delete.own': 1,
+      'content.publish.own': 1, 'content.edit.any': 1, 'content.delete.any': 1, 'content.publish.any': 1,
+      'insights.read': 1, 'hero.read': 1, 'hero.manage': 1, 'operator.manage': 1, 'users.manage': 1,
+    },
+    service: {
+      'content.read': 1, 'content.create': 1, 'content.edit.own': 1, 'content.delete.own': 1,
+      'content.publish.own': 1, 'content.edit.any': 1, 'content.delete.any': 1, 'content.publish.any': 1,
+      'insights.read': 1, 'hero.read': 1, 'hero.manage': 1, 'operator.manage': 1, 'users.manage': 0,
+    },
+    editor: {
+      'content.read': 1, 'content.create': 1, 'content.edit.own': 1, 'content.delete.own': 1,
+      'content.publish.own': 1, 'content.edit.any': 1, 'content.delete.any': 1, 'content.publish.any': 1,
+      'insights.read': 1, 'hero.read': 1, 'hero.manage': 1, 'operator.manage': 0, 'users.manage': 0,
+    },
+    author: {
+      'content.read': 1, 'content.create': 1, 'content.edit.own': 1, 'content.delete.own': 1,
+      'content.publish.own': 1, 'content.edit.any': 0, 'content.delete.any': 0, 'content.publish.any': 0,
+      'insights.read': 1, 'hero.read': 1, 'hero.manage': 0, 'operator.manage': 0, 'users.manage': 0,
+    },
+    contributor: {
+      'content.read': 1, 'content.create': 1, 'content.edit.own': 1, 'content.delete.own': 1,
+      'content.publish.own': 0, 'content.edit.any': 0, 'content.delete.any': 0, 'content.publish.any': 0,
+      'insights.read': 1, 'hero.read': 1, 'hero.manage': 0, 'operator.manage': 0, 'users.manage': 0,
+    },
+    // Reviewer is a true read-only role: reads catalog/queues/insights,
+    // authors nothing.
+    reviewer: {
+      'content.read': 1, 'content.create': 0, 'content.edit.own': 0, 'content.delete.own': 0,
+      'content.publish.own': 0, 'content.edit.any': 0, 'content.delete.any': 0, 'content.publish.any': 0,
+      'insights.read': 1, 'hero.read': 1, 'hero.manage': 0, 'operator.manage': 0, 'users.manage': 0,
+    },
+  }
+
+  for (const role of ROLES) {
+    for (const cap of CAPABILITIES) {
+      it(`${role} ${MATRIX[role][cap] ? 'holds' : 'lacks'} ${cap}`, () => {
+        expect(roleCan(role, cap)).toBe(MATRIX[role][cap] === 1)
+      })
+    }
+  }
+
+  it('ROLE_CAPABILITIES covers every role', () => {
+    for (const role of ROLES) expect(ROLE_CAPABILITIES[role]).toBeInstanceOf(Set)
+  })
+})
+
+describe('isPrivileged / isAdmin equivalence (behavior-preserving R1)', () => {
+  it('operator.manage is held by exactly admin + service (the old isPrivileged set)', () => {
+    const holders = ROLES.filter(r => roleCan(r, 'operator.manage'))
+    expect(holders.sort()).toEqual(['admin', 'service'])
+  })
+
+  it('users.manage is held by admin only (the old isAdmin set — excludes service)', () => {
+    const holders = ROLES.filter(r => roleCan(r, 'users.manage'))
+    expect(holders).toEqual(['admin'])
+  })
+})
+
+describe('normalizeRole', () => {
+  it('maps legacy strings to canonical roles', () => {
+    expect(normalizeRole('publisher')).toBe('author')
+    expect(normalizeRole('readonly')).toBe('reviewer')
+  })
+  it('passes canonical roles through', () => {
+    for (const r of ROLES) expect(normalizeRole(r)).toBe(r)
+  })
+  it('fails closed: unknown / null → reviewer (least privilege)', () => {
+    expect(normalizeRole('wizard')).toBe('reviewer')
+    expect(normalizeRole(null)).toBe('reviewer')
+    expect(normalizeRole(undefined)).toBe('reviewer')
+  })
+})
+
+describe('capabilitiesForRole', () => {
+  it('returns the granted capabilities, honoring legacy aliases', () => {
+    expect(capabilitiesForRole('publisher')).toEqual(capabilitiesForRole('author'))
+    expect(capabilitiesForRole('admin')).toEqual([...CAPABILITIES])
+    expect(capabilitiesForRole('contributor')).not.toContain('content.publish.own')
+  })
+})
diff --git a/src/types/publisher-roles.ts b/src/types/publisher-roles.ts
new file mode 100644
index 000000000..76d1c7f04
--- /dev/null
+++ b/src/types/publisher-roles.ts
@@ -0,0 +1,144 @@
+/**
+ * Publisher roles & capabilities — the single source of truth for the
+ * portal's authorization model, shared by the Cloudflare Pages
+ * Functions backend (`functions/`) and the SPA portal
+ * (`src/ui/publisher/`). Mirrors the shape of `node-features.ts`: a
+ * pure, dependency-free constant both tiers import so the policy lives
+ * in exactly one table.
+ *
+ * Design: `docs/PUBLISHER_ROLES_PLAN.md`.
+ *
+ * A **capability** is a verb the server checks, independent of role.
+ * A **role** maps to a set of capabilities. Gates ask
+ * `roleCan(role, cap)` (server: `can(publisher, cap)`), never
+ * `role === '...'`.
+ *
+ * `reviewer` (post-`0039`; the legacy `readonly`) is a true read-only
+ * role: it may read the catalog, queues, and insights but authors
+ * nothing. The legacy `publisher` / `readonly` strings are accepted as
+ * aliases of `author` / `reviewer` (see {@link normalizeRole}) so a
+ * mid-deploy read of an un-migrated row still resolves correctly.
+ */
+
+/** The capability vocabulary (see the plan doc §3). */
+export const CAPABILITIES = [
+  'content.read',
+  'content.create',
+  'content.edit.own',
+  'content.delete.own',
+  'content.publish.own',
+  'content.edit.any',
+  'content.delete.any',
+  'content.publish.any',
+  'insights.read',
+  'hero.read',
+  'hero.manage',
+  'operator.manage',
+  'users.manage',
+] as const
+
+export type Capability = (typeof CAPABILITIES)[number]
+
+/**
+ * Canonical role identifiers. `author` / `reviewer` are the post-`0039`
+ * names for the legacy `publisher` / `readonly` strings; both are
+ * accepted on the wire (see {@link normalizeRole}). `service` is the
+ * non-assignable machine role (capability-equivalent to `admin`).
+ */
+export const ROLES = ['admin', 'editor', 'author', 'contributor', 'reviewer', 'service'] as const
+export type Role = (typeof ROLES)[number]
+
+/** Roles an admin may assign through the Users tab (excludes the
+ *  machine-only `service`). Ordered most- to least-privileged. */
+export const ASSIGNABLE_ROLES: readonly Role[] = ['admin', 'editor', 'author', 'contributor', 'reviewer']
+
+const ALL: ReadonlySet<Capability> = new Set(CAPABILITIES)
+
+// The machine role is capability-equivalent to admin for content +
+// operator work, but must NOT manage users — a leaked service token
+// must not be able to promote/suspend publishers. This mirrors today's
+// `isAdmin` (strictly `role === 'admin'`, excluding `service`).
+const SERVICE_CAPS: ReadonlySet<Capability> = new Set(
+  CAPABILITIES.filter(c => c !== 'users.manage'),
+)
+
+// --- The matrix. Each role → the capabilities it holds. ------------------
+
+// Read-only: catalog + queues + insights, authors nothing.
+const READ_ONLY_CAPS: ReadonlySet<Capability> = new Set<Capability>([
+  'content.read',
+  'insights.read',
+  'hero.read',
+])
+
+const AUTHOR_CAPS: ReadonlySet<Capability> = new Set<Capability>([
+  'content.read',
+  'content.create',
+  'content.edit.own',
+  'content.delete.own',
+  'content.publish.own',
+  'insights.read',
+  'hero.read',
+])
+
+const CONTRIBUTOR_CAPS: ReadonlySet<Capability> = new Set<Capability>([
+  'content.read',
+  'content.create',
+  'content.edit.own',
+  'content.delete.own',
+  'insights.read',
+  'hero.read',
+])
+
+const EDITOR_CAPS: ReadonlySet<Capability> = new Set<Capability>([
+  ...AUTHOR_CAPS,
+  'content.edit.any',
+  'content.delete.any',
+  'content.publish.any',
+  'hero.manage',
+])
+
+export const ROLE_CAPABILITIES: Record<Role, ReadonlySet<Capability>> = {
+  admin: ALL,
+  service: SERVICE_CAPS,
+  editor: EDITOR_CAPS,
+  author: AUTHOR_CAPS,
+  contributor: CONTRIBUTOR_CAPS,
+  reviewer: READ_ONLY_CAPS,
+}
+
+/**
+ * Fold a stored role string (which may still be a legacy
+ * `publisher` / `readonly` value pre-`0039`, or an unknown string) into
+ * a canonical {@link Role}. Unknown roles fall to the least-privileged
+ * `reviewer` — fail-closed, the opposite of the feature-toggle
+ * fail-open, because this gates writes.
+ */
+export function normalizeRole(role: string | null | undefined): Role {
+  switch (role) {
+    case 'admin':
+    case 'editor':
+    case 'author':
+    case 'contributor':
+    case 'reviewer':
+    case 'service':
+      return role
+    case 'publisher':
+      return 'author'
+    case 'readonly':
+      return 'reviewer'
+    default:
+      return 'reviewer'
+  }
+}
+
+/** Whether `role` (canonical or legacy string) holds `cap`. */
+export function roleCan(role: string | null | undefined, cap: Capability): boolean {
+  return ROLE_CAPABILITIES[normalizeRole(role)].has(cap)
+}
+
+/** The full capability list a role holds — for `GET /publish/me` and
+ *  the portal's `can()` helper. */
+export function capabilitiesForRole(role: string | null | undefined): Capability[] {
+  return CAPABILITIES.filter(c => ROLE_CAPABILITIES[normalizeRole(role)].has(c))
+}
diff --git a/src/ui/publisher/components/events/event-detail.test.ts b/src/ui/publisher/components/events/event-detail.test.ts
index 4968aa293..f7c79317b 100644
--- a/src/ui/publisher/components/events/event-detail.test.ts
+++ b/src/ui/publisher/components/events/event-detail.test.ts
@@ -208,6 +208,20 @@ describe('renderEventDetail — suggested media (task: media suggestion engine)'
     expect(evt.videoEmbedUrl).toBeUndefined()
   })
 
+  it('shows the attached video to a non-editable caller without a Remove control', async () => {
+    const evt = event({
+      can_edit: false,
+      videoEmbedUrl: 'https://www.youtube-nocookie.com/embed/dQw4w9WgXcQ',
+    })
+    const pane = renderEventDetail(evt, { onEventStatusChange: vi.fn(), fetchFn: vi.fn() } as never)
+
+    const frame = pane.querySelector('.publisher-events-video-frame') as HTMLIFrameElement
+    expect(frame).not.toBeNull()
+    expect(frame.src).toBe('https://www.youtube-nocookie.com/embed/dQw4w9WgXcQ')
+    // Read-only: the frame renders, but no Remove control.
+    expect(pane.querySelector('.publisher-events-video button')).toBeNull()
+  })
+
   it('appends nearby Commons photo cards asynchronously alongside the Worldview card', async () => {
     const commonsBody = {
       query: {
diff --git a/src/ui/publisher/components/events/event-detail.ts b/src/ui/publisher/components/events/event-detail.ts
index fced03a1d..0b79a0b76 100644
--- a/src/ui/publisher/components/events/event-detail.ts
+++ b/src/ui/publisher/components/events/event-detail.ts
@@ -350,7 +350,11 @@ function renderMediaSuggestions(event: ReviewEvent, cb: EventDetailCallbacks): H
  * as the generated tour will show it, with a Remove control. The embed
  * host is re-guarded by the caller before this renders.
  */
-function renderAttachedVideo(event: ReviewEvent, cb: EventDetailCallbacks): HTMLElement {
+function renderAttachedVideo(
+  event: ReviewEvent,
+  cb: EventDetailCallbacks,
+  canEdit: boolean,
+): HTMLElement {
   const wrap = el('div', 'publisher-events-video')
   const frame = document.createElement('iframe')
   frame.className = 'publisher-events-video-frame'
@@ -361,6 +365,12 @@ function renderAttachedVideo(event: ReviewEvent, cb: EventDetailCallbacks): HTML
   frame.setAttribute('referrerpolicy', 'strict-origin-when-cross-origin')
   frame.setAttribute('allow', 'accelerometer; encrypted-media; gyroscope; picture-in-picture')
 
+  // Non-editable callers can watch the video but get no Remove control.
+  if (!canEdit) {
+    wrap.append(frame)
+    return wrap
+  }
+
   const status = el('span', 'publisher-events-edit-status')
   const remove = document.createElement('button')
   remove.type = 'button'
@@ -515,8 +525,10 @@ function renderMetadataEdit(event: ReviewEvent, cb: EventDetailCallbacks): HTMLE
   return wrap
 }
 
-/** One dataset pairing row: name · Match Badge · ✓ / ✕ icon buttons. */
-function renderLinkRow(eventId: string, link: ReviewLink, cb: EventDetailCallbacks): HTMLElement {
+/** One dataset pairing row: name · Match Badge · ✓ / ✕ icon buttons.
+ *  When `canEdit` is false the row is display-only (no decision
+ *  buttons) — the read half of read-all / write-own. */
+function renderLinkRow(eventId: string, link: ReviewLink, cb: EventDetailCallbacks, canEdit = true): HTMLElement {
   const row = el('div', `publisher-events-pairing publisher-events-pairing-${link.status}`)
   const name = el('span', 'publisher-events-pairing-name')
   name.textContent = link.datasetTitle ?? link.datasetId
@@ -573,12 +585,10 @@ function renderLinkRow(eventId: string, link: ReviewLink, cb: EventDetailCallbac
   const approveBtn = iconBtn('approve')
   const rejectBtn = iconBtn('reject')
 
-  row.append(
-    name,
-    badgeEl,
-    el('span', 'publisher-events-pairing-actions', [approveBtn, rejectBtn]),
-    rowStatus,
-  )
+  const actions = canEdit
+    ? el('span', 'publisher-events-pairing-actions', [approveBtn, rejectBtn])
+    : el('span', 'publisher-events-pairing-actions')
+  row.append(name, badgeEl, actions, rowStatus)
   return row
 }
 
@@ -586,6 +596,13 @@ function renderLinkRow(eventId: string, link: ReviewLink, cb: EventDetailCallbac
 export function renderEventDetail(event: ReviewEvent, cb: EventDetailCallbacks): HTMLElement {
   const pane = el('div', 'publisher-events-detail')
 
+  // Read-all / write-own: every publisher sees the full detail, but the
+  // review + edit affordances only appear on events the caller may
+  // mutate (its owner / an admin / an unclaimed event). `can_edit`
+  // absent (older payload / fixture) is treated as editable; the server
+  // enforces every write regardless.
+  const canEdit = event.can_edit !== false
+
   // --- Header: title + status badge ---
   const badgeEl = badge(event.status)
   pane.append(
@@ -595,6 +612,10 @@ export function renderEventDetail(event: ReviewEvent, cb: EventDetailCallbacks):
     ]),
   )
 
+  if (!canEdit) {
+    pane.append(el('p', 'publisher-events-readonly-notice', [t('publisher.events.readonly.notice')]))
+  }
+
   // --- Event-level decision (the heavy tier) — placed directly under the
   // title so a curator can triage (Approve / Reject) and clean the queue
   // without scrolling past the media, meta strip, and dataset pairings.
@@ -635,13 +656,15 @@ export function renderEventDetail(event: ReviewEvent, cb: EventDetailCallbacks):
   approveEvent.addEventListener('click', () => submitEvent('approve'))
   rejectEvent.addEventListener('click', () => submitEvent('reject'))
 
-  pane.append(
-    el('div', 'publisher-events-decision', [
-      el('p', 'publisher-events-decision-prompt', [t('publisher.events.decision.prompt')]),
-      el('div', 'publisher-events-decision-actions', [approveEvent, rejectEvent]),
-      decisionStatus,
-    ]),
-  )
+  if (canEdit) {
+    pane.append(
+      el('div', 'publisher-events-decision', [
+        el('p', 'publisher-events-decision-prompt', [t('publisher.events.decision.prompt')]),
+        el('div', 'publisher-events-decision-actions', [approveEvent, rejectEvent]),
+        decisionStatus,
+      ]),
+    )
+  }
 
   // --- Story image (feed enclosure / og:image) — rendered so the
   // curator vets it alongside the text; approving the event approves
@@ -655,22 +678,25 @@ export function renderEventDetail(event: ReviewEvent, cb: EventDetailCallbacks):
     img.loading = 'lazy'
     // A dead image link should vanish, not show a broken-image glyph.
     img.addEventListener('error', () => img.remove())
-    pane.append(img, renderImageUpload(event, cb, 'replace'))
-  } else {
+    pane.append(img)
+    if (canEdit) pane.append(renderImageUpload(event, cb, 'replace'))
+  } else if (canEdit) {
     // The publisher's own photo is always an option, located or not.
     pane.append(renderImageUpload(event, cb, 'upload'))
   }
 
   // --- Attached agency video (the picked YouTube embed) — framed for
-  // the curator to vet, with a Remove control. Independent of the image.
+  // the curator to vet. Independent of the image. Read-all/write-own:
+  // everyone can watch the attached video; only editable callers get the
+  // Remove control.
   if (event.videoEmbedUrl && isNocookieEmbedUrl(event.videoEmbedUrl)) {
-    pane.append(renderAttachedVideo(event, cb))
+    pane.append(renderAttachedVideo(event, cb, canEdit))
   }
 
   // --- Suggested media (task: media suggestion engine) — image
   // sources while imageless, the agency-YouTube source while videoless;
   // each pick writes through the review endpoint's edits.
-  const suggest = renderMediaSuggestions(event, cb)
+  const suggest = canEdit ? renderMediaSuggestions(event, cb) : null
   if (suggest) pane.append(suggest)
 
   // --- Meta strip: source / first observed / detail ---
@@ -707,7 +733,7 @@ export function renderEventDetail(event: ReviewEvent, cb: EventDetailCallbacks):
   // Location is constrained to the same regions.ts vocabulary the
   // enrichment uses (offered via a datalist); the backend re-runs the
   // matcher so the pairing signals score the corrected values.
-  pane.append(renderMetadataEdit(event, cb))
+  if (canEdit) pane.append(renderMetadataEdit(event, cb))
 
   // --- Locator: live map slot, coordinates as text fallback ---
   const point = locatorPoint(event.geometry)
@@ -734,7 +760,7 @@ export function renderEventDetail(event: ReviewEvent, cb: EventDetailCallbacks):
 
   const bulkStatus = el('span', 'publisher-events-bulk-status')
   bulkStatus.setAttribute('role', 'status')
-  const targets = autoPairTargets(event)
+  const targets = canEdit ? autoPairTargets(event) : []
   if (targets.length > 0) {
     const bulkBtn = document.createElement('button')
     bulkBtn.type = 'button'
@@ -810,7 +836,7 @@ export function renderEventDetail(event: ReviewEvent, cb: EventDetailCallbacks):
       tourBtn.disabled = false
     })
   })
-  headActions.append(tourBtn)
+  if (canEdit) headActions.append(tourBtn)
   // Generating a tour needs the tours feature (the endpoint checks it
   // too) — hide the action when the toggle is off. The map is
   // module-cached, so this resolves without a network round-trip.
@@ -826,7 +852,7 @@ export function renderEventDetail(event: ReviewEvent, cb: EventDetailCallbacks):
   addBtn.className = 'publisher-button publisher-button-small publisher-events-add-btn'
   addBtn.textContent = t('publisher.events.addDataset')
   addBtn.setAttribute('aria-expanded', 'false')
-  headActions.append(addBtn)
+  if (canEdit) headActions.append(addBtn)
 
   pairings.append(head, bulkStatus, tourStatus)
 
@@ -837,7 +863,7 @@ export function renderEventDetail(event: ReviewEvent, cb: EventDetailCallbacks):
       rowsHost.append(el('p', 'publisher-events-nolinks', [t('publisher.events.noLinks')]))
       return
     }
-    for (const link of event.links) rowsHost.append(renderLinkRow(event.id, link, cb))
+    for (const link of event.links) rowsHost.append(renderLinkRow(event.id, link, cb, canEdit))
   }
   rebuildRows()
 
@@ -929,7 +955,10 @@ export function renderEventDetail(event: ReviewEvent, cb: EventDetailCallbacks):
     })
   })
 
-  pairings.append(addPanel, rowsHost)
+  // The add-dataset panel is a write affordance — only mount it (and its
+  // toggle) for editable events; read-only sees just the pairing rows.
+  if (canEdit) pairings.append(addPanel, rowsHost)
+  else pairings.append(rowsHost)
   pane.append(pairings)
 
   return pane
diff --git a/src/ui/publisher/components/events/events-model.ts b/src/ui/publisher/components/events/events-model.ts
index 6cb61d5d6..c31c8d8b9 100644
--- a/src/ui/publisher/components/events/events-model.ts
+++ b/src/ui/publisher/components/events/events-model.ts
@@ -64,6 +64,13 @@ export interface ReviewEvent {
    *  generated tour frames it; independent of the story image. */
   videoEmbedUrl?: string
   links: ReviewLink[]
+  /** Whether the caller may review/edit this event: its owner (with
+   *  `content.edit.own`), or an `content.edit.any` holder
+   *  (editor / admin / service) — the latter also covers as-yet-unclaimed
+   *  events (`owner_id === null`), which are editable only at the `.any`
+   *  tier, not by any active publisher. Absent (older payload / fixture)
+   *  is treated as editable; the server is the authoritative gate. */
+  can_edit?: boolean
 }
 
 export interface EventsResponse {
diff --git a/src/ui/publisher/components/sidebar.test.ts b/src/ui/publisher/components/sidebar.test.ts
index a91353d58..755fb49a5 100644
--- a/src/ui/publisher/components/sidebar.test.ts
+++ b/src/ui/publisher/components/sidebar.test.ts
@@ -37,13 +37,16 @@ describe('renderSidebar', () => {
 
   it('renders the non-admin nav in grouped order', () => {
     renderSidebar(host, router)
-    // Admin-only items (Feeds/Events/Blog/Node profile/Team) are hidden.
+    // Events and Blog are visible to every publisher (read-all / write-own);
+    // admin-only items (Feeds/Node profile/Team) stay hidden.
     expect(linkLabels(host)).toEqual([
       'Overview',
       'Datasets',
       'Workflows',
       'Import',
+      'Events',
       'Right now',
+      'Blog',
       'Tours',
       'Analytics',
       'Feedback',
@@ -63,18 +66,19 @@ describe('renderSidebar', () => {
     renderSidebar(host, router, { isAdmin: true })
     const labels = linkLabels(host)
     expect(labels).toContain('Feeds')
-    expect(labels).toContain('Events')
-    expect(labels).toContain('Blog')
     expect(labels).toContain('Node profile')
     expect(labels).toContain('Team')
   })
 
-  it('hides admin-only links by default', () => {
+  it('hides admin-only links by default but shows Events + Blog to every publisher', () => {
     renderSidebar(host, router)
     const labels = linkLabels(host)
     expect(labels).not.toContain('Feeds')
-    expect(labels).not.toContain('Events')
+    expect(labels).not.toContain('Node profile')
     expect(labels).not.toContain('Team')
+    // Events + Blog are no longer admin-only.
+    expect(labels).toContain('Events')
+    expect(labels).toContain('Blog')
   })
 
   it('hides links whose feature toggle is off', () => {
@@ -111,12 +115,13 @@ describe('renderSidebar', () => {
     expect(linkLabels(host)).toContain('Tours')
   })
 
-  it('renders the events badge only when the count is positive and admin', () => {
-    renderSidebar(host, router, { isAdmin: true, eventsBadge: 8 })
+  it('renders the events badge only when the count is positive (visible to every publisher)', () => {
+    // Events is no longer admin-only, so the badge shows for any publisher.
+    renderSidebar(host, router, { eventsBadge: 8 })
     const badge = host.querySelector('.publisher-nav-badge')
     expect(badge?.textContent).toBe('8')
 
-    renderSidebar(host, router, { isAdmin: true, eventsBadge: 0 })
+    renderSidebar(host, router, { eventsBadge: 0 })
     expect(host.querySelector('.publisher-nav-badge')).toBeNull()
   })
 
diff --git a/src/ui/publisher/components/sidebar.ts b/src/ui/publisher/components/sidebar.ts
index 5adb02b3f..e4fefc171 100644
--- a/src/ui/publisher/components/sidebar.ts
+++ b/src/ui/publisher/components/sidebar.ts
@@ -81,9 +81,9 @@ const NAV_GROUPS: ReadonlyArray<NavGroup> = [
     labelKey: 'publisher.nav.group.newsroom',
     items: [
       { path: '/publish/feeds', labelKey: 'publisher.nav.feeds', adminOnly: true, feature: 'events' },
-      { path: '/publish/events', labelKey: 'publisher.nav.events', adminOnly: true, feature: 'events', badge: 'events' },
+      { path: '/publish/events', labelKey: 'publisher.nav.events', feature: 'events', badge: 'events' },
       { path: '/publish/featured-hero', labelKey: 'publisher.nav.featuredHero', feature: 'hero' },
-      { path: '/publish/blog', labelKey: 'publisher.nav.blog', adminOnly: true, feature: 'blog' },
+      { path: '/publish/blog', labelKey: 'publisher.nav.blog', feature: 'blog' },
       { path: '/publish/tours', labelKey: 'publisher.nav.tours', feature: 'tours' },
     ],
   },
diff --git a/src/ui/publisher/pages/analytics.ts b/src/ui/publisher/pages/analytics.ts
index 790ccf128..54cef24c4 100644
--- a/src/ui/publisher/pages/analytics.ts
+++ b/src/ui/publisher/pages/analytics.ts
@@ -2,10 +2,11 @@
  * /publish/analytics — the operator analytics dashboard (Phase B of
  * `docs/ANALYTICS_STORAGE_AND_ADMIN_PLAN.md`).
  *
- * Privileged-only (staff / admin / service), same client-side gate
- * as featured-hero (the API enforces 403 regardless). Data comes
- * from `GET /api/v1/publish/analytics` — typed sections over the
- * Phase A rollup tables; everything shown is a sample-weighted
+ * Read-only for any active publisher — the dashboard has no mutation
+ * controls (CSV export is built client-side), so view access is open;
+ * the operator backfill in `analytics-export.ts` stays privileged.
+ * Data comes from `GET /api/v1/publish/analytics` — typed sections
+ * over the Phase A rollup tables; everything shown is a sample-weighted
  * estimate over complete UTC days through yesterday, external
  * traffic only.
  *
@@ -46,7 +47,6 @@ import {
 } from '../analytics-charts'
 
 
-const ME_ENDPOINT = '/api/v1/publish/me'
 const ANALYTICS_ENDPOINT = '/api/v1/publish/analytics'
 /** Vendored Natural Earth 1:110m land polygons + admin-0 country
  * boundary lines (public domain), minified + coordinate-rounded —
@@ -69,11 +69,6 @@ const ENVIRONMENTS = ['production', 'preview'] as const
  * export both derive the cell center by adding half this. */
 const SPATIAL_BIN_DEG = 0.5
 
-interface MeResponse {
-  role: string
-  is_admin: boolean
-}
-
 interface Envelope<T> {
   since_day: string
   through_day: string
@@ -174,10 +169,6 @@ interface PageState {
   spatialProjection: string | undefined
 }
 
-function clientIsPrivileged(me: MeResponse): boolean {
-  return me.is_admin === true || me.role === 'admin' || me.role === 'service'
-}
-
 function el<K extends keyof HTMLElementTagNameMap>(
   tag: K,
   props: Partial<HTMLElementTagNameMap[K]> & { className?: string } = {},
@@ -227,29 +218,9 @@ export async function renderAnalyticsPage(
     shell(el('p', { className: 'publisher-loading', textContent: t('publisher.analytics.loading') })),
   )
 
-  const meRes = await publisherGet<MeResponse>(ME_ENDPOINT, { fetchFn })
-  if (!meRes.ok) {
-    if (meRes.kind === 'session') {
-      if (handleSessionError({ navigate: options.navigate }) === 'navigating') return
-      mount.replaceChildren(shell(buildErrorCard('session')))
-      return
-    }
-    const details = meRes.kind === 'server' ? { status: meRes.status, body: meRes.body } : {}
-    mount.replaceChildren(shell(buildErrorCard(meRes.kind, details)))
-    return
-  }
-  if (!clientIsPrivileged(meRes.data)) {
-    mount.replaceChildren(
-      shell(
-        el('h1', { textContent: t('publisher.analytics.title') }),
-        el('p', {
-          className: 'publisher-hero-restricted',
-          textContent: t('publisher.analytics.restricted'),
-        }),
-      ),
-    )
-    return
-  }
+  // Analytics is a read-only dashboard, open to any active publisher.
+  // The per-section data reads below surface any session/server error;
+  // there's no separate role gate here.
 
   const state: PageState = {
     days: 30,
diff --git a/src/ui/publisher/pages/blog-edit.test.ts b/src/ui/publisher/pages/blog-edit.test.ts
index d0cbf22bc..a27094924 100644
--- a/src/ui/publisher/pages/blog-edit.test.ts
+++ b/src/ui/publisher/pages/blog-edit.test.ts
@@ -524,15 +524,37 @@ describe('renderBlogEditPage', () => {
     expect(notes.toLowerCase()).toContain('add a location')
   })
 
-  it('shows the restricted card for a non-privileged caller', async () => {
+  it('renders the New-post editor with no client-side role gate (the server enforces content.create on save)', async () => {
     const mount = document.createElement('div')
     const fetchFn = vi.fn(async (input: RequestInfo | URL) => {
       const url = typeof input === 'string' ? input : (input as Request).url
-      const body = url.includes('/publish/me') ? { role: 'publisher', is_admin: false } : {}
+      // No postId → only feature/catalog/events reads; return empty lists.
+      const body = url.includes('/publish/datasets') || url.includes('/publish/events') ? { datasets: [], events: [], posts: [] } : {}
       return { ok: true, status: 200, type: 'basic', json: async () => body, text: async () => JSON.stringify(body) } as unknown as Response
     })
     await renderBlogEditPage(mount, { fetchFn })
-    expect(mount.querySelector('.publisher-blog-restricted')).toBeTruthy()
+    // The form renders — no restricted wall.
+    expect(mount.querySelector('#blog-title')).toBeTruthy()
+    expect(mount.querySelector('.publisher-blog-restricted')).toBeNull()
+  })
+
+  it('renders a read-only view (no form) for a post the caller does not own', async () => {
+    const mount = document.createElement('div')
+    const post = {
+      id: 'P9', slug: 'someone-elses', title: 'Not mine', summary: null,
+      bodyMd: '# Hello\n\nBody text.', datasetIds: [], eventId: null, status: 'draft',
+      publishedAt: null, tourId: null, coverImageUrl: null, coverImageAlt: null,
+      can_edit: false,
+    }
+    const fetchFn = vi.fn(async (input: RequestInfo | URL) => {
+      const url = typeof input === 'string' ? input : (input as Request).url
+      const body = url.includes('/publish/blog/P9') ? { post } : { datasets: [], events: [] }
+      return { ok: true, status: 200, type: 'basic', json: async () => body, text: async () => JSON.stringify(body) } as unknown as Response
+    })
+    await renderBlogEditPage(mount, { fetchFn, postId: 'P9' })
+    // View-only: the post title + notice render, but no editing form.
     expect(mount.querySelector('#blog-title')).toBeNull()
+    expect(mount.querySelector('.publisher-blog-readonly-notice')).toBeTruthy()
+    expect(mount.querySelector('.publisher-blog-preview')?.textContent).toContain('Body text.')
   })
 })
diff --git a/src/ui/publisher/pages/blog-edit.ts b/src/ui/publisher/pages/blog-edit.ts
index 32f6c148a..403d36f94 100644
--- a/src/ui/publisher/pages/blog-edit.ts
+++ b/src/ui/publisher/pages/blog-edit.ts
@@ -46,11 +46,6 @@ import { resolveRegion } from '../../../data/regions'
 import { renderMarkdown } from '../../../services/markdownRenderer'
 import type { PublisherDataset } from '../types'
 
-interface MeResponse {
-  role: string
-  is_admin: boolean
-}
-
 interface PostWire {
   id: string
   slug: string
@@ -64,9 +59,11 @@ interface PostWire {
   tourId: string | null
   coverImageUrl: string | null
   coverImageAlt: string | null
+  /** Whether the caller may edit this post (author or admin). Absent
+   *  on create / older payloads → treated as editable. */
+  can_edit?: boolean
 }
 
-const ME_ENDPOINT = '/api/v1/publish/me'
 const BLOG_ENDPOINT = '/api/v1/publish/blog'
 // Approved only: the public post drops a citation whose event isn't
 // approved, and generation grounds itself in the event's text — the
@@ -84,10 +81,6 @@ export interface BlogEditPageOptions {
   postId?: string
 }
 
-function clientIsPrivileged(me: MeResponse): boolean {
-  return me.is_admin === true || me.role === 'admin' || me.role === 'service'
-}
-
 function el<K extends keyof HTMLElementTagNameMap>(
   tag: K,
   props: Partial<HTMLElementTagNameMap[K]> & { className?: string } = {},
@@ -174,6 +167,59 @@ function withResolvedGeometry(ev: ReviewEvent): ReviewEvent {
   return { ...ev, geometry: { ...g, boundingBox: { n, s, w, e } } }
 }
 
+/** View-only rendering of a post the caller doesn't own — the
+ *  read half of read-all / write-own. Title + status + a sanitized
+ *  markdown render of the body, plus the public link when published.
+ *  No form, no Save. */
+function renderReadOnlyPost(
+  mount: HTMLElement,
+  post: PostWire,
+  navigate: (url: string) => void,
+): void {
+  const back = el('button', {
+    type: 'button',
+    className: 'publisher-button publisher-blog-back',
+    textContent: t('publisher.blog.editor.back'),
+  })
+  back.addEventListener('click', () => navigate('/publish/blog'))
+
+  const head = el('div', { className: 'publisher-blog-header' }, [
+    el('div', { className: 'publisher-page-titles' }, [
+      el('h2', { className: 'publisher-card-heading', textContent: post.title }),
+      el('span', {
+        className: `publisher-blog-badge publisher-blog-badge-${post.status}`,
+        textContent:
+          post.status === 'published'
+            ? t('publisher.blog.status.published')
+            : t('publisher.blog.status.draft'),
+      }),
+    ]),
+  ])
+
+  const notice = el('p', {
+    className: 'publisher-blog-readonly-notice',
+    textContent: t('publisher.blog.readonly.notice'),
+  })
+
+  const bodyView = el('div', { className: 'publisher-blog-preview publisher-markdown-body' })
+  // renderMarkdown runs marked + sanitizeMarkdownHtml (XSS-tested).
+  bodyView.innerHTML = renderMarkdown(post.bodyMd)
+
+  const children: HTMLElement[] = [back, head, notice]
+  if (post.status === 'published') {
+    const view = el('a', {
+      className: 'publisher-row-action publisher-blog-view-link',
+      href: `/blog/${encodeURIComponent(post.slug)}`,
+      textContent: t('publisher.blog.list.view'),
+    })
+    view.target = '_blank'
+    view.rel = 'noopener'
+    children.push(view)
+  }
+  children.push(bodyView)
+  mount.replaceChildren(shell(card(...children)))
+}
+
 export async function renderBlogEditPage(mount: HTMLElement, options: BlogEditPageOptions = {}): Promise<void> {
   const features = await fetchFeatures()
   if (!features.blog) {
@@ -184,38 +230,29 @@ export async function renderBlogEditPage(mount: HTMLElement, options: BlogEditPa
   const navigate = options.navigate ?? ((url: string) => { window.location.href = url })
   mount.replaceChildren(shell(el('p', { className: 'publisher-loading', textContent: t('publisher.blog.loading') })))
 
-  const [meRes, postRes] = await Promise.all([
-    publisherGet<MeResponse>(ME_ENDPOINT, { fetchFn }),
-    options.postId
-      ? publisherGet<{ post: PostWire }>(`${BLOG_ENDPOINT}/${encodeURIComponent(options.postId)}`, { fetchFn })
-      : Promise.resolve(null),
-  ])
-  for (const res of [meRes, postRes]) {
-    if (!res || res.ok) continue
-    if (res.kind === 'session') {
+  const postRes = options.postId
+    ? await publisherGet<{ post: PostWire }>(`${BLOG_ENDPOINT}/${encodeURIComponent(options.postId)}`, { fetchFn })
+    : null
+  if (postRes && !postRes.ok) {
+    if (postRes.kind === 'session') {
       if (handleSessionError({ navigate: options.navigate }) === 'navigating') return
       mount.replaceChildren(shell(buildErrorCard('session')))
       return
     }
-    const details = res.kind === 'server' ? { status: res.status, body: res.body } : {}
-    mount.replaceChildren(shell(buildErrorCard(res.kind, details)))
-    return
-  }
-  if (!meRes.ok || (postRes && !postRes.ok)) return
-
-  if (!clientIsPrivileged(meRes.data)) {
-    mount.replaceChildren(
-      shell(
-        card(
-          el('h2', { className: 'publisher-card-heading', textContent: t('publisher.blog.editor.title') }),
-          el('p', { className: 'publisher-blog-restricted', textContent: t('publisher.blog.restricted') }),
-        ),
-      ),
-    )
+    const details = postRes.kind === 'server' ? { status: postRes.status, body: postRes.body } : {}
+    mount.replaceChildren(shell(buildErrorCard(postRes.kind, details)))
     return
   }
 
   const existing = postRes?.ok ? postRes.data.post : null
+
+  // Read-all / write-own: any active publisher may open the editor to
+  // create a draft, but a post authored by someone else is view-only.
+  // `can_edit` absent (create / older payload) is treated as editable.
+  if (existing && existing.can_edit === false) {
+    renderReadOnlyPost(mount, existing, navigate)
+    return
+  }
   let postId = existing?.id ?? null
   let postStatus: 'draft' | 'published' = existing?.status ?? 'draft'
   // The AI-generated companion tour (tours-row id). Set by a
diff --git a/src/ui/publisher/pages/blog.test.ts b/src/ui/publisher/pages/blog.test.ts
index 2d24d5c92..a0b8b036c 100644
--- a/src/ui/publisher/pages/blog.test.ts
+++ b/src/ui/publisher/pages/blog.test.ts
@@ -6,7 +6,6 @@
 import { describe, expect, it, vi } from 'vitest'
 import { renderBlogPage } from './blog'
 
-const ADMIN_ME = { role: 'admin', is_admin: true }
 const LIST = {
   posts: [
     { id: 'P1', slug: 'live-post', title: 'Live post', status: 'published', updatedAt: '2026-07-01T00:00:00.000Z', publishedAt: '2026-07-01T00:00:00.000Z' },
@@ -14,10 +13,11 @@ const LIST = {
   ],
 }
 
-function mockFetch() {
+function mockFetch(meRole = 'admin') {
+  const me = { role: meRole, is_admin: meRole === 'admin' }
   return vi.fn(async (input: RequestInfo | URL) => {
     const url = typeof input === 'string' ? input : (input as Request).url
-    const body = url.includes('/publish/me') ? ADMIN_ME : LIST
+    const body = url.includes('/publish/me') ? me : LIST
     return { ok: true, status: 200, type: 'basic', json: async () => body, text: async () => JSON.stringify(body) } as unknown as Response
   })
 }
@@ -32,4 +32,14 @@ describe('renderBlogPage', () => {
     expect(views[0].getAttribute('href')).toBe('/blog/live-post')
     expect(views[0].rel).toContain('noopener')
   })
+
+  it('shows the New-post button for an author but hides it for a reviewer', async () => {
+    const authorMount = document.createElement('div')
+    await renderBlogPage(authorMount, { fetchFn: mockFetch('author'), navigate: vi.fn() })
+    expect(authorMount.querySelector('.publisher-blog-new-btn')).not.toBeNull()
+
+    const reviewerMount = document.createElement('div')
+    await renderBlogPage(reviewerMount, { fetchFn: mockFetch('reviewer'), navigate: vi.fn() })
+    expect(reviewerMount.querySelector('.publisher-blog-new-btn')).toBeNull()
+  })
 })
diff --git a/src/ui/publisher/pages/blog.ts b/src/ui/publisher/pages/blog.ts
index 64720b2b8..fb74f7f9e 100644
--- a/src/ui/publisher/pages/blog.ts
+++ b/src/ui/publisher/pages/blog.ts
@@ -3,21 +3,17 @@
  * `docs/CURRENT_EVENTS_PLAN.md` §7).
  *
  * Lists every post (drafts included, newest-updated first) with a
- * status badge, linking each row into the editor
- * (`/publish/blog/:id/edit`) plus a "New post" button
- * (`/publish/blog/new`). Privileged-gated client-side — the API
- * enforces 403 on writes independently. Mirrors `tours.ts`.
+ * status badge. Readable by any active publisher; each row's authoring
+ * controls are gated on `can_edit` (the post's author, or an admin) —
+ * others get a read-only View link. Writes are enforced server-side
+ * regardless. Mirrors `tours.ts`.
  */
 
 import { fetchFeatures, renderFeatureDisabledCard } from '../features'
 import { t } from '../../../i18n'
 import { publisherGet, handleSessionError } from '../api'
 import { buildErrorCard } from '../components/error-card'
-
-interface MeResponse {
-  role: string
-  is_admin: boolean
-}
+import { roleCan } from '../../../types/publisher-roles'
 
 export interface BlogPostListItem {
   id: string
@@ -26,24 +22,24 @@ export interface BlogPostListItem {
   status: 'draft' | 'published'
   updatedAt: string
   publishedAt: string | null
+  /** Whether the caller may edit/publish this post (author or admin).
+   *  Absent (older payload / fixture) is treated as editable; the
+   *  server is the authoritative gate. */
+  can_edit?: boolean
 }
 
 interface BlogListResponse {
   posts: BlogPostListItem[]
 }
 
-const ME_ENDPOINT = '/api/v1/publish/me'
 const BLOG_ENDPOINT = '/api/v1/publish/blog'
+const ME_ENDPOINT = '/api/v1/publish/me'
 
 export interface BlogPageOptions {
   fetchFn?: typeof fetch
   navigate?: (url: string) => void
 }
 
-function clientIsPrivileged(me: MeResponse): boolean {
-  return me.is_admin === true || me.role === 'admin' || me.role === 'service'
-}
-
 function el<K extends keyof HTMLElementTagNameMap>(
   tag: K,
   props: Partial<HTMLElementTagNameMap[K]> & { className?: string } = {},
@@ -76,32 +72,15 @@ export async function renderBlogPage(mount: HTMLElement, options: BlogPageOption
   const navigate = options.navigate ?? ((url: string) => { window.location.href = url })
   mount.replaceChildren(shell(el('p', { className: 'publisher-loading', textContent: t('publisher.blog.loading') })))
 
-  const [meRes, listRes] = await Promise.all([
-    publisherGet<MeResponse>(ME_ENDPOINT, { fetchFn }),
-    publisherGet<BlogListResponse>(BLOG_ENDPOINT, { fetchFn }),
-  ])
-  for (const res of [meRes, listRes]) {
-    if (res.ok) continue
-    if (res.kind === 'session') {
+  const listRes = await publisherGet<BlogListResponse>(BLOG_ENDPOINT, { fetchFn })
+  if (!listRes.ok) {
+    if (listRes.kind === 'session') {
       if (handleSessionError({ navigate: options.navigate }) === 'navigating') return
       mount.replaceChildren(shell(buildErrorCard('session')))
       return
     }
-    const details = res.kind === 'server' ? { status: res.status, body: res.body } : {}
-    mount.replaceChildren(shell(buildErrorCard(res.kind, details)))
-    return
-  }
-  if (!meRes.ok || !listRes.ok) return
-
-  if (!clientIsPrivileged(meRes.data)) {
-    mount.replaceChildren(
-      shell(
-        card(
-          el('h2', { className: 'publisher-card-heading', textContent: t('publisher.blog.title') }),
-          el('p', { className: 'publisher-blog-restricted', textContent: t('publisher.blog.restricted') }),
-        ),
-      ),
-    )
+    const details = listRes.kind === 'server' ? { status: listRes.status, body: listRes.body } : {}
+    mount.replaceChildren(shell(buildErrorCard(listRes.kind, details)))
     return
   }
 
@@ -112,13 +91,21 @@ export async function renderBlogPage(mount: HTMLElement, options: BlogPageOption
       el('p', { className: 'publisher-page-subtitle', textContent: t('publisher.blog.subtitle') }),
     ]),
   )
-  const newBtn = el('button', {
-    type: 'button',
-    className: 'publisher-button publisher-button-primary publisher-blog-new-btn',
-    textContent: t('publisher.blog.new'),
-  })
-  newBtn.addEventListener('click', () => navigate('/publish/blog/new'))
-  header.append(newBtn)
+  // Drafting a blog post needs `content.create`; a reviewer can read
+  // the list but not author, so omit the New-post button rather than
+  // send them into an editor they can't save. Fail-open on a `/me`
+  // error — the server stays the authoritative gate.
+  const meRes = await publisherGet<{ role: string }>(ME_ENDPOINT, { fetchFn })
+  const canCreate = !meRes.ok || roleCan(meRes.data.role, 'content.create')
+  if (canCreate) {
+    const newBtn = el('button', {
+      type: 'button',
+      className: 'publisher-button publisher-button-primary publisher-blog-new-btn',
+      textContent: t('publisher.blog.new'),
+    })
+    newBtn.addEventListener('click', () => navigate('/publish/blog/new'))
+    header.append(newBtn)
+  }
 
   const body = card(header)
   const posts = listRes.data.posts
@@ -162,21 +149,24 @@ export async function renderBlogPage(mount: HTMLElement, options: BlogPageOption
       titleCell.append(titleStack)
       tr.append(titleCell)
       tr.append(el('td', { className: 'publisher-cell-updated', textContent: post.updatedAt.slice(0, 10) }))
-      // Actions: Edit (all rows, opens the editor) + View (published
-      // only — a public page to link to). Consistent action pills with
-      // the other list pages.
+      // Actions: Edit for posts the caller authored (or admin); others
+      // get read-only access via the title link + the public View link
+      // when published. Writes are enforced server-side regardless.
       const actionsCell = el('td', { className: 'publisher-cell-actions' })
-      const edit = el('a', {
-        className: 'publisher-row-action publisher-row-edit',
-        href: `/publish/blog/${encodeURIComponent(post.id)}/edit`,
-        textContent: t('publisher.blog.list.edit'),
-      })
-      edit.addEventListener('click', e => {
-        if (e.button !== 0 || e.metaKey || e.ctrlKey || e.shiftKey || e.altKey) return
-        e.preventDefault()
-        navigate(`/publish/blog/${encodeURIComponent(post.id)}/edit`)
-      })
-      actionsCell.append(edit)
+      const canEdit = post.can_edit !== false
+      if (canEdit) {
+        const edit = el('a', {
+          className: 'publisher-row-action publisher-row-edit',
+          href: `/publish/blog/${encodeURIComponent(post.id)}/edit`,
+          textContent: t('publisher.blog.list.edit'),
+        })
+        edit.addEventListener('click', e => {
+          if (e.button !== 0 || e.metaKey || e.ctrlKey || e.shiftKey || e.altKey) return
+          e.preventDefault()
+          navigate(`/publish/blog/${encodeURIComponent(post.id)}/edit`)
+        })
+        actionsCell.append(edit)
+      }
       if (post.status === 'published') {
         const view = el('a', {
           className: 'publisher-row-action publisher-blog-view-link',
diff --git a/src/ui/publisher/pages/dataset-detail.test.ts b/src/ui/publisher/pages/dataset-detail.test.ts
index 0a295c35b..1f9ed62ff 100644
--- a/src/ui/publisher/pages/dataset-detail.test.ts
+++ b/src/ui/publisher/pages/dataset-detail.test.ts
@@ -247,6 +247,20 @@ describe('renderDatasetDetailPage', () => {
     expect(edit?.textContent).toBe('Edit')
   })
 
+  it('hides Edit / Preview / Retract when the caller cannot edit the row', async () => {
+    const fetchFn = vi.fn().mockResolvedValue(detailResponse(dataset({ can_edit: false })))
+    await renderDatasetDetailPage(mount, '01ABC', {
+      fetchFn: fetchFn as unknown as typeof fetch,
+    })
+    // Read-only view: the row still renders, but none of the
+    // owner-scoped mutation affordances appear.
+    expect(mount.querySelector('.publisher-detail-edit')).toBeNull()
+    expect(mount.querySelector('.publisher-detail-preview')).toBeNull()
+    expect(mount.querySelector('.publisher-detail-title')?.textContent).toBe(
+      'Sea Surface Temperature Anomaly — April 2026',
+    )
+  })
+
   it('Edit button delegates to routerNavigate on a plain click', async () => {
     const fetchFn = vi.fn().mockResolvedValue(detailResponse(dataset()))
     const routerNavigate = vi.fn<(path: string) => void>()
@@ -304,6 +318,20 @@ describe('renderDatasetDetailPage', () => {
     expect(mount.querySelector('.publisher-detail-publish')).toBeNull()
   })
 
+  it('hides Publish for a contributor who can edit but not publish (can_publish=false)', async () => {
+    // A contributor's own draft: editable, but no publish rights.
+    const fetchFn = vi.fn().mockResolvedValue(
+      detailResponse(dataset({ published_at: null, can_edit: true, can_publish: false })),
+    )
+    await renderDatasetDetailPage(mount, '01ABC', {
+      fetchFn: fetchFn as unknown as typeof fetch,
+    })
+    // Edit is still offered (they can edit their draft)…
+    expect(mount.querySelector('.publisher-detail-edit')).not.toBeNull()
+    // …but the Publish control is hidden (server also 403s).
+    expect(mount.querySelector('.publisher-detail-publish')).toBeNull()
+  })
+
   it('renders a Publish button on a retracted row (re-publish path)', async () => {
     const fetchFn = vi
       .fn()
diff --git a/src/ui/publisher/pages/dataset-detail.ts b/src/ui/publisher/pages/dataset-detail.ts
index c03bd9ad0..e1d7eb687 100644
--- a/src/ui/publisher/pages/dataset-detail.ts
+++ b/src/ui/publisher/pages/dataset-detail.ts
@@ -153,67 +153,81 @@ function renderHeader(d: PublisherDatasetDetail, hooks: HeaderHooks): HTMLElemen
     titleRow.appendChild(transcodingBadge)
   }
 
-  const editHref = `/publish/datasets/${encodeURIComponent(d.id)}/edit`
-  const editLink = document.createElement('a')
-  editLink.className = 'publisher-button publisher-button-secondary publisher-detail-edit'
-  editLink.href = editHref
-  editLink.textContent = t('publisher.datasetDetail.editAction')
-  if (hooks.routerNavigate) {
-    editLink.addEventListener('click', event => {
-      // Plain left-click + no modifier → SPA navigation. Anything
-      // else (cmd-click, middle-click, etc.) falls through to the
-      // browser so the publisher can still open the edit form in a
-      // new tab.
-      if (
-        event.button === 0 &&
-        !event.metaKey &&
-        !event.ctrlKey &&
-        !event.shiftKey &&
-        !event.altKey
-      ) {
-        event.preventDefault()
-        hooks.routerNavigate!(editHref)
-      }
-    })
-  }
-  titleRow.appendChild(editLink)
-
-  // Preview button — mints a 15-minute signed token and surfaces
-  // the SPA-side `/?preview=<token>&dataset=<id>` URL so the
-  // publisher can share an unpublished draft as a live globe
-  // rendering. The SPA consumer (3pe/C) fetches the wire-shape
-  // metadata + the token-gated manifest sibling, then runs the
-  // dataset through the regular loader path. Hidden while
-  // transcoding (data_ref is empty so there'd be nothing to
-  // render). See `dispatchPreview` below for the rationale.
-  if (!d.transcoding) {
-    const previewBtn = document.createElement('button')
-    previewBtn.type = 'button'
-    previewBtn.className =
-      'publisher-button publisher-button-secondary publisher-detail-preview'
-    previewBtn.textContent = t('publisher.datasetDetail.action.preview')
-    previewBtn.addEventListener('click', () => {
-      hooks.onPreview?.()
-    })
-    titleRow.appendChild(previewBtn)
-  }
+  // Edit / Preview / Publish / Retract are all owner-scoped writes.
+  // Every publisher can view any row in the catalog, but the mutation
+  // controls only appear on rows the caller may actually change
+  // (`can_edit`). Absent (older payload / fixture) is treated as
+  // editable; the server is the authoritative gate regardless of what
+  // the UI shows.
+  const canEdit = d.can_edit !== false
+  if (canEdit) {
+    const editHref = `/publish/datasets/${encodeURIComponent(d.id)}/edit`
+    const editLink = document.createElement('a')
+    editLink.className = 'publisher-button publisher-button-secondary publisher-detail-edit'
+    editLink.href = editHref
+    editLink.textContent = t('publisher.datasetDetail.editAction')
+    if (hooks.routerNavigate) {
+      editLink.addEventListener('click', event => {
+        // Plain left-click + no modifier → SPA navigation. Anything
+        // else (cmd-click, middle-click, etc.) falls through to the
+        // browser so the publisher can still open the edit form in a
+        // new tab.
+        if (
+          event.button === 0 &&
+          !event.metaKey &&
+          !event.ctrlKey &&
+          !event.shiftKey &&
+          !event.altKey
+        ) {
+          event.preventDefault()
+          hooks.routerNavigate!(editHref)
+        }
+      })
+    }
+    titleRow.appendChild(editLink)
+
+    // Preview button — mints a 15-minute signed token and surfaces
+    // the SPA-side `/?preview=<token>&dataset=<id>` URL so the
+    // publisher can share an unpublished draft as a live globe
+    // rendering. The SPA consumer (3pe/C) fetches the wire-shape
+    // metadata + the token-gated manifest sibling, then runs the
+    // dataset through the regular loader path. Hidden while
+    // transcoding (data_ref is empty so there'd be nothing to
+    // render). See `dispatchPreview` below for the rationale.
+    if (!d.transcoding) {
+      const previewBtn = document.createElement('button')
+      previewBtn.type = 'button'
+      previewBtn.className =
+        'publisher-button publisher-button-secondary publisher-detail-preview'
+      previewBtn.textContent = t('publisher.datasetDetail.action.preview')
+      previewBtn.addEventListener('click', () => {
+        hooks.onPreview?.()
+      })
+      titleRow.appendChild(previewBtn)
+    }
 
-  // Drafts and retracted rows surface a "Publish" affordance;
-  // published rows surface "Retract". The route handlers accept
-  // re-publishing a retracted row (it clears retracted_at and
-  // re-stamps published_at) so the same button does double duty.
-  //
-  // While a row is transcoding (Phase 3pd video upload in flight)
-  // the Publish button is gated: data_ref is empty until the GHA
-  // workflow finishes, so the publish-readiness validator would
-  // reject anyway. Disabling here gives the publisher a clearer
-  // signal than "submit-then-error."
-  if (status === 'published') {
-    titleRow.appendChild(renderActionButton('retract', hooks.onAction))
-  } else {
-    titleRow.appendChild(
-      renderActionButton('publish', hooks.onAction, { disabled: !!d.transcoding }),
-    )
+    // Drafts and retracted rows surface a "Publish" affordance;
+    // published rows surface "Retract". The route handlers accept
+    // re-publishing a retracted row (it clears retracted_at and
+    // re-stamps published_at) so the same button does double duty.
+    // Publishing is a privilege above editing: a contributor edits its
+    // own draft but can't publish it (`can_publish === false`), so the
+    // control is hidden for them. The server also 403s.
+    //
+    // While a row is transcoding (Phase 3pd video upload in flight)
+    // the Publish button is gated: data_ref is empty until the GHA
+    // workflow finishes, so the publish-readiness validator would
+    // reject anyway. Disabling here gives the publisher a clearer
+    // signal than "submit-then-error."
+    if (d.can_publish !== false) {
+      if (status === 'published') {
+        titleRow.appendChild(renderActionButton('retract', hooks.onAction))
+      } else {
+        titleRow.appendChild(
+          renderActionButton('publish', hooks.onAction, { disabled: !!d.transcoding }),
+        )
+      }
+    }
   }
 
   header.appendChild(titleRow)
diff --git a/src/ui/publisher/pages/dataset-edit.test.ts b/src/ui/publisher/pages/dataset-edit.test.ts
index 465c992cd..8b117e9d9 100644
--- a/src/ui/publisher/pages/dataset-edit.test.ts
+++ b/src/ui/publisher/pages/dataset-edit.test.ts
@@ -98,6 +98,18 @@ describe('renderDatasetEditPage', () => {
     )
   })
 
+  it('redirects a non-owner (can_edit=false) to the read-only detail page instead of the form', async () => {
+    const fetchFn = vi.fn().mockResolvedValue(detailResponse(dataset({ can_edit: false })))
+    const navigate = vi.fn<(url: string) => void>()
+    await renderDatasetEditPage(mount, '01EDIT0000000000000000000', {
+      fetchFn: fetchFn as unknown as typeof fetch,
+      navigate,
+    })
+    expect(navigate).toHaveBeenCalledWith('/publish/datasets/01EDIT0000000000000000000')
+    // The form is not mounted for a read-only caller.
+    expect(mount.querySelector<HTMLInputElement>('#dataset-title')).toBeNull()
+  })
+
   it('surfaces the existing data_ref via the asset uploader’s "current" line + the manual override input', async () => {
     const fetchFn = vi.fn().mockResolvedValue(
       detailResponse(dataset({ data_ref: 'r2:videos/01XYZ/master.m3u8' })),
diff --git a/src/ui/publisher/pages/dataset-edit.ts b/src/ui/publisher/pages/dataset-edit.ts
index 0b833f31e..850d5bae0 100644
--- a/src/ui/publisher/pages/dataset-edit.ts
+++ b/src/ui/publisher/pages/dataset-edit.ts
@@ -96,6 +96,17 @@ export async function renderDatasetEditPage(
     return
   }
   clearWarmupFlag()
+  // The whole catalog is visible, but editing stays owner-scoped. A
+  // non-owner who deep-links to `/edit` (the Edit affordance is hidden
+  // for them elsewhere) is bounced to the read-only detail page rather
+  // than shown a form whose Save would 404. `can_edit` absent (older
+  // payload / fixture) is treated as editable.
+  if (result.data.dataset.can_edit === false) {
+    const detailHref = `/publish/datasets/${encodeURIComponent(id)}`
+    if (options.navigate) options.navigate(detailHref)
+    else window.location.href = detailHref
+    return
+  }
   renderDatasetForm(content, {
     ...options,
     mode: 'edit',
diff --git a/src/ui/publisher/pages/datasets.test.ts b/src/ui/publisher/pages/datasets.test.ts
index 0a021c766..46f51c1e6 100644
--- a/src/ui/publisher/pages/datasets.test.ts
+++ b/src/ui/publisher/pages/datasets.test.ts
@@ -16,6 +16,7 @@ interface RawDataset {
   publisher_id: string | null
   legacy_id: string | null
   thumbnail_url?: string | null
+  can_edit?: boolean
 }
 
 function dataset(overrides: Partial<RawDataset> = {}): RawDataset {
@@ -58,6 +59,35 @@ describe('renderDatasetsPage', () => {
     window.history.replaceState(null, '', originalPath)
   })
 
+  it('hides the New-draft button for a reviewer (no content.create)', async () => {
+    window.history.replaceState(null, '', '/publish/datasets')
+    const fetchFn = vi.fn().mockResolvedValue(jsonResponse({ datasets: [], next_cursor: null }))
+    const meFetchFn = vi.fn(async () => jsonResponse({ role: 'reviewer' }))
+    await renderDatasetsPage(mount, {
+      fetchFn: fetchFn as unknown as typeof fetch,
+      meFetchFn: meFetchFn as unknown as typeof fetch,
+      fetchCounts: false,
+    })
+    // Let the progressive create-gate resolve and re-render.
+    await new Promise(r => setTimeout(r, 0))
+    await new Promise(r => setTimeout(r, 0))
+    expect(mount.querySelector('.publisher-datasets-new-btn')).toBeNull()
+  })
+
+  it('keeps the New-draft button for an author (content.create)', async () => {
+    window.history.replaceState(null, '', '/publish/datasets')
+    const fetchFn = vi.fn().mockResolvedValue(jsonResponse({ datasets: [], next_cursor: null }))
+    const meFetchFn = vi.fn(async () => jsonResponse({ role: 'author' }))
+    await renderDatasetsPage(mount, {
+      fetchFn: fetchFn as unknown as typeof fetch,
+      meFetchFn: meFetchFn as unknown as typeof fetch,
+      fetchCounts: false,
+    })
+    await new Promise(r => setTimeout(r, 0))
+    await new Promise(r => setTimeout(r, 0))
+    expect(mount.querySelector('.publisher-datasets-new-btn')).not.toBeNull()
+  })
+
   it('renders a thumbnail image in the row when the dataset has one', async () => {
     window.history.replaceState(null, '', '/publish/datasets')
     const fetchFn = vi.fn().mockResolvedValue(
@@ -471,6 +501,23 @@ describe('renderDatasetsPage — delete action', () => {
     expect(mount.querySelector('.publisher-row-delete')).toBeNull()
   })
 
+  it('a row the caller cannot edit shows only a View link (no Edit/Retract/Delete)', async () => {
+    window.history.replaceState(null, '', '/publish/datasets?status=published')
+    const fetchFn = vi.fn().mockResolvedValue(
+      jsonResponse({
+        datasets: [dataset({ id: 'OTHER', published_at: '2026-04-30T12:00:00Z', can_edit: false })],
+        next_cursor: null,
+      }),
+    )
+    await renderDatasetsPage(mount, { fetchFn: fetchFn as unknown as typeof fetch, fetchCounts: false })
+    expect(mount.querySelector('.publisher-row-edit')).toBeNull()
+    expect(mount.querySelector('.publisher-row-retract')).toBeNull()
+    expect(mount.querySelector('.publisher-row-delete')).toBeNull()
+    const view = mount.querySelector('.publisher-row-view')
+    expect(view).not.toBeNull()
+    expect(view?.getAttribute('href')).toBe('/publish/datasets/OTHER')
+  })
+
   it('a confirmed Retract POSTs to the retract endpoint and drops the row', async () => {
     window.history.replaceState(null, '', '/publish/datasets?status=published')
     const calls: Array<[string, RequestInit | undefined]> = []
diff --git a/src/ui/publisher/pages/datasets.ts b/src/ui/publisher/pages/datasets.ts
index 94b3a5652..562103d6e 100644
--- a/src/ui/publisher/pages/datasets.ts
+++ b/src/ui/publisher/pages/datasets.ts
@@ -20,6 +20,7 @@ import { plural } from '../../../i18n'
 import { clearWarmupFlag, handleSessionError, publisherGet, publisherSend,
 } from '../api'
 import { buildErrorCard, type ErrorCardDetails } from '../components/error-card'
+import { roleCan } from '../../../types/publisher-roles'
 import type {
   DatasetLifecycle,
   ListDatasetsResponse,
@@ -27,6 +28,8 @@ import type {
 } from '../types'
 import { lifecycleOf } from '../types'
 
+const ME_ENDPOINT = '/api/v1/publish/me'
+
 export interface DatasetsPageOptions {
   fetchFn?: typeof fetch
   /** Confirmation hook — defaults to `window.confirm`. Tests
@@ -43,6 +46,11 @@ export interface DatasetsPageOptions {
    *  tab labels. Default true; tests that assert exact fetch call
    *  counts set it false to keep the probe out of the way. */
   fetchCounts?: boolean
+  /** Separate fetch seam for the create-gate's `/me` probe. Kept
+   *  distinct from `fetchFn` so the list-call-count assertions (which
+   *  chain `mockResolvedValueOnce` on `fetchFn`) are never perturbed by
+   *  the role lookup. Defaults to the standard authed fetch. */
+  meFetchFn?: typeof fetch
 }
 
 const DATASETS_ENDPOINT = '/api/v1/publish/datasets'
@@ -275,15 +283,41 @@ function renderTable(
     updatedCell.textContent = formatDate(d.updated_at)
     tr.appendChild(updatedCell)
 
-    // Actions: Edit (all rows) + Retract (published) / Delete
-    // (drafts & retracted). Live rows must be retracted before they
-    // can be deleted, which the API enforces with a 409 regardless
-    // of what the UI shows.
+    // Actions: for a row the caller can mutate, Edit (all rows) +
+    // Retract (published) / Delete (drafts & retracted). Live rows
+    // must be retracted before they can be deleted, which the API
+    // enforces with a 409 regardless of what the UI shows. The whole
+    // catalog is visible to every publisher, but writes stay
+    // owner-scoped — a row the caller can't mutate (`can_edit ===
+    // false`) shows only a View link. `can_edit` absent (older
+    // payload / fixture) is treated as editable; the server is the
+    // authoritative gate regardless of what the UI shows.
     const actionsCell = document.createElement('td')
     actionsCell.className = 'publisher-cell-actions'
     const statusSpan = document.createElement('span')
     statusSpan.className = 'publisher-row-action-status'
 
+    const canEdit = d.can_edit !== false
+    if (!canEdit) {
+      const detailHrefRO = `/publish/datasets/${encodeURIComponent(d.id)}`
+      const viewLink = document.createElement('a')
+      viewLink.href = detailHrefRO
+      viewLink.className = 'publisher-row-action publisher-row-view'
+      viewLink.textContent = t('publisher.datasets.action.view')
+      viewLink.setAttribute('aria-label', t('publisher.datasets.action.view.aria', { title: d.title }))
+      if (routerNavigate) {
+        viewLink.addEventListener('click', event => {
+          if (event.button !== 0 || event.metaKey || event.ctrlKey || event.shiftKey || event.altKey) return
+          event.preventDefault()
+          routerNavigate(detailHrefRO)
+        })
+      }
+      actionsCell.appendChild(viewLink)
+      tr.appendChild(actionsCell)
+      tbody.appendChild(tr)
+      continue
+    }
+
     const editHref = `/publish/datasets/${encodeURIComponent(d.id)}/edit`
     const editLink = document.createElement('a')
     editLink.href = editHref
@@ -300,34 +334,40 @@ function renderTable(
     actionsCell.appendChild(editLink)
 
     if (status === 'published') {
-      const retractBtn = document.createElement('button')
-      retractBtn.type = 'button'
-      retractBtn.className = 'publisher-row-action publisher-row-retract'
-      retractBtn.textContent = t('publisher.datasets.action.retract')
-      retractBtn.setAttribute('aria-label', t('publisher.datasets.action.retract.aria', { title: d.title }))
-      retractBtn.addEventListener('click', () => {
-        if (!confirmFn(t('publisher.datasets.retract.confirm', { title: d.title }))) return
-        retractBtn.disabled = true
-        statusSpan.textContent = ''
-        // Clear any error styling from a prior failed attempt so a
-        // retry doesn't inherit the red status text.
-        statusSpan.classList.remove('publisher-row-action-status-error')
-        void publisherSend<{ dataset: unknown }>(
-          `/api/v1/publish/datasets/${encodeURIComponent(d.id)}/retract`,
-          {},
-          { method: 'POST', fetchFn },
-        ).then(result => {
-          if (!result.ok) {
-            retractBtn.disabled = false
-            statusSpan.textContent = t('publisher.datasets.retract.failed')
-            statusSpan.classList.add('publisher-row-action-status-error')
-            return
-          }
-          // No longer published — drop it from the Published tab.
-          tr.remove()
+      // Retract is a publish-tier action — hidden for a caller who
+      // can't publish this row (e.g. a contributor whose draft an editor
+      // published). No Delete on a live row either; it must be retracted
+      // first, which such a caller can't do.
+      if (d.can_publish !== false) {
+        const retractBtn = document.createElement('button')
+        retractBtn.type = 'button'
+        retractBtn.className = 'publisher-row-action publisher-row-retract'
+        retractBtn.textContent = t('publisher.datasets.action.retract')
+        retractBtn.setAttribute('aria-label', t('publisher.datasets.action.retract.aria', { title: d.title }))
+        retractBtn.addEventListener('click', () => {
+          if (!confirmFn(t('publisher.datasets.retract.confirm', { title: d.title }))) return
+          retractBtn.disabled = true
+          statusSpan.textContent = ''
+          // Clear any error styling from a prior failed attempt so a
+          // retry doesn't inherit the red status text.
+          statusSpan.classList.remove('publisher-row-action-status-error')
+          void publisherSend<{ dataset: unknown }>(
+            `/api/v1/publish/datasets/${encodeURIComponent(d.id)}/retract`,
+            {},
+            { method: 'POST', fetchFn },
+          ).then(result => {
+            if (!result.ok) {
+              retractBtn.disabled = false
+              statusSpan.textContent = t('publisher.datasets.retract.failed')
+              statusSpan.classList.add('publisher-row-action-status-error')
+              return
+            }
+            // No longer published — drop it from the Published tab.
+            tr.remove()
+          })
         })
-      })
-      actionsCell.appendChild(retractBtn)
+        actionsCell.appendChild(retractBtn)
+      }
     } else {
       const deleteBtn = document.createElement('button')
       deleteBtn.type = 'button'
@@ -421,9 +461,13 @@ interface PageState {
   /** Client-side search query — filters the loaded rows by title/slug.
    *  Persisted on the state so it survives Load-more / tab re-renders. */
   search: string
+  /** Whether the caller may create datasets (`content.create`). Drives
+   *  the New-draft button's presence. Defaults true (fail-open); flipped
+   *  off when the `/me` probe resolves as a non-authoring role. */
+  canCreate: boolean
 }
 
-function renderHeader(routerNavigate: (path: string) => void): HTMLElement {
+function renderHeader(routerNavigate: (path: string) => void, canCreate: boolean): HTMLElement {
   const header = document.createElement('header')
   header.className = 'publisher-page-header'
 
@@ -438,16 +482,21 @@ function renderHeader(routerNavigate: (path: string) => void): HTMLElement {
   titles.append(h1, sub)
   header.appendChild(titles)
 
-  const newButton = document.createElement('a')
-  newButton.href = '/publish/datasets/new'
-  newButton.className = 'publisher-button publisher-button-primary'
-  newButton.textContent = t('publisher.datasets.newDraft')
-  newButton.addEventListener('click', e => {
-    if (e.button !== 0 || e.metaKey || e.ctrlKey || e.shiftKey || e.altKey) return
-    e.preventDefault()
-    routerNavigate('/publish/datasets/new')
-  })
-  header.appendChild(newButton)
+  // Creating a dataset needs `content.create`; a reviewer can read the
+  // catalog but not author, so omit the New-draft button rather than
+  // send them into a form they can't save.
+  if (canCreate) {
+    const newButton = document.createElement('a')
+    newButton.href = '/publish/datasets/new'
+    newButton.className = 'publisher-button publisher-button-primary publisher-datasets-new-btn'
+    newButton.textContent = t('publisher.datasets.newDraft')
+    newButton.addEventListener('click', e => {
+      if (e.button !== 0 || e.metaKey || e.ctrlKey || e.shiftKey || e.altKey) return
+      e.preventDefault()
+      routerNavigate('/publish/datasets/new')
+    })
+    header.appendChild(newButton)
+  }
   return header
 }
 
@@ -462,7 +511,7 @@ function renderListShell(
   const shell = document.createElement('main')
   shell.className = 'publisher-shell'
 
-  shell.appendChild(renderHeader(options.routerNavigate))
+  shell.appendChild(renderHeader(options.routerNavigate, state.canCreate))
   shell.appendChild(
     renderTabs(
       state.status,
@@ -616,6 +665,7 @@ export async function renderDatasetsPage(
     isLoadingMore: false,
     counts: null,
     search: '',
+    canCreate: true,
   }
   const shellOptions = {
     confirm: options.confirm,
@@ -634,6 +684,17 @@ export async function renderDatasetsPage(
   }
   renderListShell(content, state, shellOptions)
 
+  // Create-gate: drop the New-draft button for a caller without
+  // `content.create` (a reviewer). Progressive + fail-open, and on a
+  // dedicated `meFetchFn` seam so the list-call-count assertions stay
+  // pristine. Re-renders the shell in place if the role gates it off.
+  void publisherGet<{ role: string }>(ME_ENDPOINT, { fetchFn: options.meFetchFn }).then(res => {
+    if (res.ok && res.data.role && !roleCan(res.data.role, 'content.create')) {
+      state.canCreate = false
+      renderListShell(content, state, shellOptions)
+    }
+  })
+
   // Best-effort per-lifecycle counts for the tab labels. Fired after
   // the first paint so the list never blocks on them; re-renders the
   // shell in place when they resolve.
diff --git a/src/ui/publisher/pages/events.test.ts b/src/ui/publisher/pages/events.test.ts
index adda2a6dc..b159a4602 100644
--- a/src/ui/publisher/pages/events.test.ts
+++ b/src/ui/publisher/pages/events.test.ts
@@ -58,16 +58,36 @@ beforeEach(() => {
 })
 
 describe('renderEventsPage', () => {
-  it('shows the restricted card for a non-privileged publisher without hitting the events API', async () => {
+  it('a non-admin publisher reads the queue but gets no feed-Refresh button', async () => {
     const routes = baseRoutes()
     routes['/api/v1/publish/me'] = { body: { role: 'publisher', is_admin: false } }
     const fetchFn = mockFetch(routes)
     await renderEventsPage(mount, { fetchFn })
-    expect(mount.querySelector('.publisher-events-restricted')).not.toBeNull()
-    expect(mount.querySelector('.publisher-events-card')).toBeNull()
-    // Gate happens before the events fetch — a 403 there must not surface
-    // as a generic error card.
-    expect(fetchFn.mock.calls.some(c => String(c[0]).includes('/publish/events'))).toBe(false)
+    // No restricted wall — the queue renders.
+    expect(mount.querySelector('.publisher-events-restricted')).toBeNull()
+    expect(mount.querySelector('.publisher-events-queue-title')?.textContent).toBe('Hurricane makes landfall')
+    // The events queue IS fetched (read is open).
+    expect(fetchFn.mock.calls.some(c => String(c[0]).includes('/publish/events'))).toBe(true)
+    // The feed-Refresh action is admin-only; only New event shows.
+    const toolbarButtons = mount.querySelectorAll<HTMLButtonElement>('.publisher-events-toolbar button')
+    expect(toolbarButtons).toHaveLength(1)
+    expect(toolbarButtons[0].textContent).toBe('New event')
+  })
+
+  it('a non-admin publisher sees an owned event read-only when can_edit is false', async () => {
+    const routes = baseRoutes()
+    routes['/api/v1/publish/me'] = { body: { role: 'publisher', is_admin: false } }
+    const ev = oneEvent()
+    ;(ev.events[0] as { can_edit?: boolean }).can_edit = false
+    routes['/api/v1/publish/events'] = { body: ev }
+    await renderEventsPage(mount, { fetchFn: mockFetch(routes) })
+    // The detail renders, but the approve/reject decision controls do not.
+    expect(mount.querySelector('.publisher-events-detail-title')?.textContent).toBe('Hurricane makes landfall')
+    expect(mount.querySelector('.publisher-events-decision-approve')).toBeNull()
+    expect(mount.querySelector('.publisher-events-readonly-notice')).not.toBeNull()
+    // The pairing row shows, but without its ✓ / ✕ decision buttons.
+    expect(mount.querySelector('.publisher-events-pairing-name')?.textContent).toBe('Live Storm')
+    expect(mount.querySelector('.publisher-events-icon-btn')).toBeNull()
   })
 
   it('renders the selected event detail with source, title, and a pairing row', async () => {
diff --git a/src/ui/publisher/pages/events.ts b/src/ui/publisher/pages/events.ts
index 5d0abd6f6..c78805472 100644
--- a/src/ui/publisher/pages/events.ts
+++ b/src/ui/publisher/pages/events.ts
@@ -17,6 +17,7 @@
  */
 
 import { fetchFeatures, renderFeatureDisabledCard } from '../features'
+import { roleCan } from '../../../types/publisher-roles'
 import { t } from '../../../i18n'
 import { publisherGet, publisherSend, handleSessionError } from '../api'
 import { buildErrorCard } from '../components/error-card'
@@ -59,8 +60,10 @@ interface LocatorHolder {
 }
 
 /** Internal page state: the public options plus the locator holder that
- *  survives across re-renders within one page session. */
-type TriageState = EventsPageOptions & { locator: LocatorHolder }
+ *  survives across re-renders within one page session, and whether the
+ *  caller is an admin (gates the feed-Refresh action; the review
+ *  controls themselves gate per-event on `can_edit`). */
+type TriageState = EventsPageOptions & { locator: LocatorHolder; isAdmin: boolean; canCreate: boolean }
 
 function clientIsPrivileged(me: MeResponse): boolean {
   return me.is_admin === true || me.role === 'admin' || me.role === 'service'
@@ -100,17 +103,18 @@ export async function renderEventsPage(mount: HTMLElement, options: EventsPageOp
     mount.replaceChildren(shell(buildErrorCard(meRes.kind, details)))
     return
   }
-  if (!clientIsPrivileged(meRes.data)) {
-    mount.replaceChildren(
-      shell(card(
-        el('h2', 'publisher-card-heading', [t('publisher.events.title')]),
-        el('p', 'publisher-events-restricted', [t('publisher.events.restricted')]),
-      )),
-    )
-    return
-  }
-
-  await loadAndRenderQueue(mount, { fetchFn, navigate: options.navigate, locator: { dispose: null } })
+  // The whole events queue is readable by any active publisher. Writes
+  // (approve / reject / edit / tour) gate per-event on `can_edit`; the
+  // feed-Refresh action stays admin-only (it drives the feed connectors).
+  await loadAndRenderQueue(mount, {
+    fetchFn,
+    navigate: options.navigate,
+    locator: { dispose: null },
+    isAdmin: clientIsPrivileged(meRes.data),
+    // Composing a manual event needs an authoring role — derived from
+    // the `me` read the page already made (no extra request).
+    canCreate: roleCan(meRes.data.role, 'content.create'),
+  })
 }
 
 /** Fetch the queue at `status` and render the triage view. `selectId`
@@ -282,10 +286,16 @@ function renderTopbar(
     filters.append(btn)
   }
 
+  // Feed Refresh is admin-only (it runs the feed connectors); New event
+  // needs an authoring role (reviewers get neither).
+  const toolbarBtns: HTMLElement[] = []
+  if (state.isAdmin) toolbarBtns.push(refreshBtn)
+  if (state.canCreate) toolbarBtns.push(newBtn)
+  const toolbar = el('div', 'publisher-events-toolbar', toolbarBtns)
   const bar = el('div', 'publisher-events-topbar', [
     el('div', 'publisher-events-topbar-head', [
       el('h2', 'publisher-card-heading', [t('publisher.events.title')]),
-      el('div', 'publisher-events-toolbar', [refreshBtn, newBtn]),
+      toolbar,
     ]),
     el('p', 'publisher-events-intro', [t('publisher.events.subtitle')]),
     filters,
diff --git a/src/ui/publisher/pages/featured-hero.test.ts b/src/ui/publisher/pages/featured-hero.test.ts
index 4ca205edf..ad7c4b92a 100644
--- a/src/ui/publisher/pages/featured-hero.test.ts
+++ b/src/ui/publisher/pages/featured-hero.test.ts
@@ -41,12 +41,41 @@ beforeEach(() => {
 })
 
 describe('renderFeaturedHeroPage', () => {
-  it('shows a restricted card for a non-privileged publisher', async () => {
+  it('shows a read-only view (no editing controls) for a non-privileged publisher with no pin', async () => {
+    const routes = baseRoutes() // hero: null
+    routes['/api/v1/publish/me'] = { body: { role: 'publisher', is_admin: false } }
+    await renderFeaturedHeroPage(mount, { fetchFn: mockFetch(routes) })
+    // No editing controls at all.
+    expect(mount.querySelector('.publisher-hero-select')).toBeNull()
+    expect(mount.querySelector('.publisher-button')).toBeNull()
+    // The view-only notice + empty state render.
+    expect(mount.querySelector('.publisher-hero-intro')?.textContent).toContain('view-only')
+    expect(mount.querySelector('.publisher-hero-readonly-meta')?.textContent).toContain(
+      'No dataset is currently featured',
+    )
+  })
+
+  it('shows the currently-featured dataset read-only for a non-privileged publisher', async () => {
     const routes = baseRoutes()
     routes['/api/v1/publish/me'] = { body: { role: 'publisher', is_admin: false } }
+    routes['/api/v1/featured-hero'] = {
+      body: {
+        hero: {
+          datasetId: DS,
+          window: { start: '2026-07-01T00:00:00Z', end: '2026-07-08T00:00:00Z' },
+          headline: 'Storm of the week',
+        },
+      },
+    }
     await renderFeaturedHeroPage(mount, { fetchFn: mockFetch(routes) })
-    expect(mount.querySelector('.publisher-hero-restricted')).not.toBeNull()
+    // Read-only preview card with the pinned dataset's title/headline.
     expect(mount.querySelector('.publisher-hero-select')).toBeNull()
+    expect(mount.querySelector('.publisher-button')).toBeNull()
+    expect(mount.querySelector('.hero-panel-title')?.textContent).toBe('Storm of the week')
+    // Window + headline meta lines render.
+    const meta = Array.from(mount.querySelectorAll('.publisher-hero-readonly-meta')).map(n => n.textContent)
+    expect(meta.some(m => m?.includes('Active'))).toBe(true)
+    expect(meta.some(m => m?.includes('Storm of the week'))).toBe(true)
   })
 
   it('renders the form with dataset options for a privileged publisher', async () => {
@@ -180,7 +209,7 @@ describe('renderFeaturedHeroPage', () => {
   it('mounts inside a publisher-shell main landmark', async () => {
     await renderFeaturedHeroPage(mount, { fetchFn: mockFetch(baseRoutes()) })
     expect(mount.querySelector('main.publisher-shell')).not.toBeNull()
-    // The restricted path also gets the landmark.
+    // The read-only (non-privileged) path also gets the landmark.
     const r = baseRoutes()
     r['/api/v1/publish/me'] = { body: { role: 'publisher', is_admin: false } }
     mount.replaceChildren()
diff --git a/src/ui/publisher/pages/featured-hero.ts b/src/ui/publisher/pages/featured-hero.ts
index fb9278d67..787ddfb44 100644
--- a/src/ui/publisher/pages/featured-hero.ts
+++ b/src/ui/publisher/pages/featured-hero.ts
@@ -2,16 +2,18 @@
  * /publish/featured-hero — set the "Right now" hero override (Phase C
  * of `docs/HERO_ADMIN_SCOPING.md`).
  *
- * Privileged-only (staff / admin / service). The page fetches the
- * caller's role (`/api/v1/publish/me`), the catalog datasets for the
- * picker (`/api/v1/publish/datasets`), and the current pin
- * (`/api/v1/featured-hero`), then renders a form: dataset picker,
- * mandatory activation window, optional headline, a live preview of
- * the real hero card, and Set / Clear buttons wired to
+ * The page fetches the caller's role (`/api/v1/publish/me`), the
+ * catalog datasets for the picker (`/api/v1/publish/datasets`), and
+ * the current pin (`/api/v1/featured-hero`).
+ *
+ * Callers with `hero.manage` (editor / admin / service) get the editing
+ * form: dataset picker, mandatory activation window, optional headline,
+ * a live preview of the real hero card, and Set / Clear buttons wired to
  * `PUT` / `DELETE /api/v1/publish/featured-hero`.
  *
- * Non-privileged callers get a restricted card (the API also enforces
- * 403, but gating here avoids a fill-then-reject round-trip).
+ * Everyone else (author / contributor / reviewer) gets a read-only view
+ * of the currently-featured dataset — no editing controls. The write
+ * endpoints stay 403 server-side regardless.
  *
  * The preview reuses the live hero-panel stylesheet so the curator
  * sees exactly what ships. The portal boots its own CSS bundle
@@ -20,9 +22,11 @@
 
 import { fetchFeatures, renderFeatureDisabledCard } from '../features'
 import { t } from '../../../i18n'
+import { formatDate } from '../../../i18n/format'
 import { publisherGet, publisherSend, handleSessionError } from '../api'
 import { buildErrorCard } from '../components/error-card'
 import { dateTimeToIso } from '../components/dataset-form'
+import { roleCan } from '../../../types/publisher-roles'
 import '../../../styles/hero-panel.css'
 
 /** Keep in sync with `HERO_HEADLINE_MAX_LEN` in the backend store
@@ -55,8 +59,10 @@ export interface FeaturedHeroPageOptions {
   navigate?: (url: string) => void
 }
 
-function clientIsPrivileged(me: MeResponse): boolean {
-  return me.is_admin === true || me.role === 'admin' || me.role === 'service'
+/** The hero is an editorial curation call — editors and admins may set
+ *  it (`hero.manage`), authors and below get the read-only view. */
+function clientCanManageHero(me: MeResponse): boolean {
+  return roleCan(me.role, 'hero.manage')
 }
 
 /** Split an ISO timestamp into the local-time `YYYY-MM-DD` value an
@@ -132,15 +138,14 @@ export async function renderFeaturedHeroPage(
   // After the guard above, all three are ok — narrow the types.
   if (!meRes.ok || !datasetsRes.ok || !heroRes.ok) return
 
-  if (!clientIsPrivileged(meRes.data)) {
-    mount.replaceChildren(
-      shell(
-        card(
-          heading(t('publisher.hero.title')),
-          el('p', { className: 'publisher-hero-restricted', textContent: t('publisher.hero.restricted') }),
-        ),
-      ),
-    )
+  if (!clientCanManageHero(meRes.data)) {
+    // Read-only view: a non-admin publisher can see which dataset is
+    // currently featured (and its window / headline) but not change
+    // it. The write endpoints stay 403 server-side regardless.
+    renderReadOnly(mount, {
+      datasets: datasetsRes.data.datasets,
+      currentHero: heroRes.data.hero,
+    })
     return
   }
 
@@ -152,6 +157,80 @@ export async function renderFeaturedHeroPage(
   })
 }
 
+interface ReadOnlyState {
+  datasets: DatasetsResponse['datasets']
+  currentHero: HeroResponse['hero']
+}
+
+/** Render the view-only hero surface for non-admin publishers: the
+ *  currently-featured dataset (preview card + window + headline) or an
+ *  empty state, with no editing controls. */
+function renderReadOnly(mount: HTMLElement, state: ReadOnlyState): void {
+  const { datasets, currentHero } = state
+  const children: HTMLElement[] = [
+    heading(t('publisher.hero.title')),
+    el('p', { className: 'publisher-hero-intro', textContent: t('publisher.hero.readonly.notice') }),
+  ]
+
+  if (currentHero) {
+    const ds = datasets.find(d => d.id === currentHero.datasetId)
+    const display = currentHero.headline?.trim() || ds?.title || currentHero.datasetId
+    children.push(
+      el('span', { className: 'publisher-field-label', textContent: t('publisher.hero.readonly.current') }),
+      heroPreviewCard(display, ds?.thumbnail_url ?? null),
+      el('p', {
+        className: 'publisher-hero-readonly-meta',
+        textContent: t('publisher.hero.readonly.window', {
+          start: formatWindowStamp(currentHero.window.start),
+          end: formatWindowStamp(currentHero.window.end),
+        }),
+      }),
+    )
+    if (currentHero.headline?.trim()) {
+      children.push(
+        el('p', {
+          className: 'publisher-hero-readonly-meta',
+          textContent: t('publisher.hero.readonly.headline', { headline: currentHero.headline.trim() }),
+        }),
+      )
+    }
+  } else {
+    children.push(
+      el('p', { className: 'publisher-hero-readonly-meta', textContent: t('publisher.hero.readonly.none') }),
+    )
+  }
+
+  mount.replaceChildren(shell(card(...children)))
+}
+
+/** Build the live hero-panel preview card for a given title + thumb.
+ *  Shared shape with `renderForm`'s live preview so the read-only view
+ *  looks identical to what ships. */
+function heroPreviewCard(title: string, thumb: string | null): HTMLElement {
+  const preview = el('div', { className: 'publisher-hero-preview hero-panel' })
+  const inner = el('div', { className: 'hero-panel-inner' })
+  const cardBtn = el('div', { className: 'hero-panel-card' })
+  if (thumb) cardBtn.append(el('img', { className: 'hero-panel-thumb', src: thumb, alt: '' }))
+  cardBtn.append(
+    el('span', { className: 'hero-panel-text' }, [
+      el('span', { className: 'hero-panel-eyebrow', textContent: t('browse.hero.heading') }),
+      el('span', { className: 'hero-panel-title', textContent: title }),
+      el('span', { className: 'hero-panel-badge', textContent: t('browse.hero.label') }),
+    ]),
+  )
+  inner.append(cardBtn)
+  preview.append(inner)
+  return preview
+}
+
+/** Locale-aware date+time for the read-only window display. Falls back
+ *  to the raw ISO string when unparseable. */
+function formatWindowStamp(iso: string): string {
+  const ms = Date.parse(iso)
+  if (!Number.isFinite(ms)) return iso
+  return formatDate(new Date(ms), { dateStyle: 'medium', timeStyle: 'short' })
+}
+
 /** Wrap page content in the portal's `<main class="publisher-shell">`
  *  landmark, matching the other portal pages (see index.ts). */
 function shell(...children: HTMLElement[]): HTMLElement {
diff --git a/src/ui/publisher/pages/feedback.ts b/src/ui/publisher/pages/feedback.ts
index 93985b7f4..541f182a9 100644
--- a/src/ui/publisher/pages/feedback.ts
+++ b/src/ui/publisher/pages/feedback.ts
@@ -4,9 +4,9 @@
  *
  * Replaces the hand-rolled HTML dashboard the legacy
  * `/api/feedback-admin` endpoint served (its `?action=` CSV/JSONL
- * machine exports survive and are linked from here). Privileged-only,
- * same client gate as featured-hero/analytics; data comes from
- * `GET /api/v1/publish/feedback`, which fronts the same
+ * machine exports survive and are linked from here). Read-only for
+ * any active publisher — the page never mutates feedback; data comes
+ * from `GET /api/v1/publish/feedback`, which fronts the same
  * `_feedback-helpers` data layer the old dashboard used.
  *
  * Two views, switched by tabs:
@@ -31,17 +31,11 @@ import { buildErrorCard } from '../components/error-card'
 import { ROUTE_CHANGE_START_EVENT } from '../router'
 import { renderBarSeries, renderStatTile } from '../analytics-charts'
 
-const ME_ENDPOINT = '/api/v1/publish/me'
 const FEEDBACK_ENDPOINT = '/api/v1/publish/feedback'
 const AI_EXPORT_URL = '/api/feedback-admin?action=ai-export&include_prompt=true'
 const GENERAL_EXPORT_URL = '/api/feedback-admin?action=general-export'
 const RANGE_CHOICES = [7, 30, 90, 365] as const
 
-interface MeResponse {
-  role: string
-  is_admin: boolean
-}
-
 interface AiRow {
   rating: string
   comment: string
@@ -99,10 +93,6 @@ export interface FeedbackPageOptions {
   navigate?: (url: string) => void
 }
 
-function clientIsPrivileged(me: MeResponse): boolean {
-  return me.is_admin === true || me.role === 'admin' || me.role === 'service'
-}
-
 function el<K extends keyof HTMLElementTagNameMap>(
   tag: K,
   props: Partial<HTMLElementTagNameMap[K]> & { className?: string } = {},
@@ -140,29 +130,9 @@ export async function renderFeedbackPage(
     shell(el('p', { className: 'publisher-loading', textContent: t('publisher.feedback.loading') })),
   )
 
-  const meRes = await publisherGet<MeResponse>(ME_ENDPOINT, { fetchFn })
-  if (!meRes.ok) {
-    if (meRes.kind === 'session') {
-      if (handleSessionError({ navigate: options.navigate }) === 'navigating') return
-      mount.replaceChildren(shell(buildErrorCard('session')))
-      return
-    }
-    const details = meRes.kind === 'server' ? { status: meRes.status, body: meRes.body } : {}
-    mount.replaceChildren(shell(buildErrorCard(meRes.kind, details)))
-    return
-  }
-  if (!clientIsPrivileged(meRes.data)) {
-    mount.replaceChildren(
-      shell(
-        el('h1', { textContent: t('publisher.feedback.title') }),
-        el('p', {
-          className: 'publisher-hero-restricted',
-          textContent: t('publisher.feedback.restricted'),
-        }),
-      ),
-    )
-    return
-  }
+  // Feedback review is a read-only surface, open to any active
+  // publisher. The per-view data reads below surface any session /
+  // server error; there's no separate role gate here.
 
   const state = { view: 'ai' as 'ai' | 'general', days: 30 as (typeof RANGE_CHOICES)[number] }
   const contentHost = el('section', { className: 'publisher-feedback-content' })
diff --git a/src/ui/publisher/pages/import.test.ts b/src/ui/publisher/pages/import.test.ts
index 879efe311..ab2829145 100644
--- a/src/ui/publisher/pages/import.test.ts
+++ b/src/ui/publisher/pages/import.test.ts
@@ -9,6 +9,21 @@ import {
   countByStatus,
 } from './import'
 
+// Keep the feature toggles deterministic: fetchFeatures otherwise does a
+// live no-store network read (ECONNREFUSED in tests, with racy timing),
+// which the sequenced role-gate now awaits. Return all-features-on so the
+// gate runs; renderFeatureDisabledCard stays real for the sync tests.
+vi.mock('../features', async importOriginal => {
+  const actual = await importOriginal<typeof import('../features')>()
+  return {
+    ...actual,
+    fetchFeatures: vi.fn(async () => {
+      const { defaultFeatures } = await import('../../../types/node-features')
+      return defaultFeatures()
+    }),
+  }
+})
+
 describe('import pure helpers', () => {
   it('parseCsv keys rows by lower-cased headers and handles quotes', () => {
     const rows = parseCsv('Title,Format\n"Sea, Surface","mp4"\nArctic Ice,png\n')
@@ -75,6 +90,19 @@ describe('import pure helpers', () => {
   })
 })
 
+/** Minimal `/me` fetch stub returning the given role. */
+function meFetch(role: string) {
+  return vi.fn(async () => ({
+    ok: true,
+    status: 200,
+    type: 'basic',
+    json: async () => ({ role }),
+    text: async () => JSON.stringify({ role }),
+  }) as unknown as Response)
+}
+
+const flush = () => new Promise<void>(r => setTimeout(r, 0))
+
 describe('renderImportPage', () => {
   let mount: HTMLDivElement
 
@@ -127,4 +155,23 @@ describe('renderImportPage', () => {
     // No preview until a file is dropped, so no submit yet.
     expect(mount.querySelector('.publisher-import-submit')).toBeNull()
   })
+
+  it('shows a restricted card for a reviewer (no content.create) and hides the import UI', async () => {
+    renderImportPage(mount, { fetchFn: meFetch('reviewer') })
+    // Sequenced probes: fetchFeatures resolves, then the /me gate — two
+    // async hops, so settle both before asserting.
+    await flush()
+    await flush()
+    expect(mount.querySelector('.publisher-import-restricted')).not.toBeNull()
+    expect(mount.querySelector('.publisher-import-dropzone')).toBeNull()
+    expect(mount.querySelectorAll('.publisher-import-method').length).toBe(0)
+  })
+
+  it('leaves the import UI in place for a role that can create (author)', async () => {
+    renderImportPage(mount, { fetchFn: meFetch('author') })
+    await flush()
+    await flush()
+    expect(mount.querySelector('.publisher-import-restricted')).toBeNull()
+    expect(mount.querySelector('.publisher-import-dropzone')).not.toBeNull()
+  })
 })
diff --git a/src/ui/publisher/pages/import.ts b/src/ui/publisher/pages/import.ts
index c49482a96..b7654c692 100644
--- a/src/ui/publisher/pages/import.ts
+++ b/src/ui/publisher/pages/import.ts
@@ -18,12 +18,22 @@
 import { fetchFeatures, renderFeatureDisabledCard } from '../features'
 import { t, type MessageKey } from '../../../i18n'
 import { downloadCsv } from '../analytics-charts'
+import { publisherGet } from '../api'
+import { roleCan } from '../../../types/publisher-roles'
 
 export interface ImportPageOptions {
   /** Injectable so the copy-to-clipboard button is testable. */
   clipboard?: { writeText: (s: string) => Promise<void> }
+  /** Injectable for the role gate's `/me` fetch (tests). */
+  fetchFn?: typeof fetch
 }
 
+interface MeResponse {
+  role: string
+}
+
+const ME_ENDPOINT = '/api/v1/publish/me'
+
 const MAX_ROWS = 500
 const CLI_COMMAND = 'terraviz import ./datasets.csv --as-drafts'
 
@@ -490,13 +500,40 @@ function renderCliPanel(options: ImportPageOptions): HTMLElement {
  * fetch; the whole surface renders immediately and re-renders in
  * place as the user picks a method or drops a manifest.
  */
+/** Import creates draft datasets, so it requires `content.create`
+ *  (contributor / author / editor / admin / service). Reviewers — who
+ *  can read the catalog but author nothing — get a restricted card
+ *  instead of a create UI that would only 403 on submit. The future
+ *  bulk-import endpoint must enforce the same capability server-side. */
+function restrictedShell(): HTMLElement {
+  const shell = el('main', 'publisher-shell publisher-import')
+  const header = el('header', 'publisher-import-header')
+  header.appendChild(el('h1', 'publisher-import-title', t('publisher.import.title')))
+  header.appendChild(el('p', 'publisher-import-subtitle', t('publisher.import.subtitle')))
+  shell.appendChild(header)
+  shell.appendChild(el('p', 'publisher-import-restricted', t('publisher.import.restricted')))
+  return shell
+}
+
 export function renderImportPage(mount: HTMLElement, options: ImportPageOptions = {}): void {
   const state: PageState = { method: 'manifest', rows: null, parseErrorKey: undefined, fileName: '' }
 
-  // Sync render first (this page has no loading state); swap in the
-  // disabled card if the toggles resolve off. Fail-open on any error.
+  // Sync render first (this page has no loading state); then swap in the
+  // disabled card if the toggles resolve off, or the restricted card if
+  // the caller can't create datasets. The two probes are sequenced (not
+  // run in parallel) so the feature-disabled card takes precedence and a
+  // later-resolving role gate can't overwrite it. Fail-open on any fetch
+  // error — the server stays the authoritative gate on the real endpoint.
   void fetchFeatures().then(features => {
-    if (!features.datasets) renderFeatureDisabledCard(mount, 'datasets')
+    if (!features.datasets) {
+      renderFeatureDisabledCard(mount, 'datasets')
+      return
+    }
+    return publisherGet<MeResponse>(ME_ENDPOINT, { fetchFn: options.fetchFn }).then(res => {
+      if (res.ok && !roleCan(res.data.role, 'content.create')) {
+        mount.replaceChildren(restrictedShell())
+      }
+    })
   })
 
   const rerender = (): void => {
diff --git a/src/ui/publisher/pages/me.test.ts b/src/ui/publisher/pages/me.test.ts
index 2793921a2..4531c74a6 100644
--- a/src/ui/publisher/pages/me.test.ts
+++ b/src/ui/publisher/pages/me.test.ts
@@ -75,13 +75,14 @@ describe('renderMePage', () => {
     expect(adminBadge?.textContent).toBe('Admin')
   })
 
-  it('renders a publisher role with the plain role badge (no admin styling)', async () => {
+  it('renders a legacy publisher role as its canonical Author badge (no admin styling)', async () => {
     const payload = samplePayload({ role: 'publisher', is_admin: false })
     const fetchFn = vi.fn().mockResolvedValue(jsonResponse(payload))
     await renderMePage(mount, { fetchFn: fetchFn as unknown as typeof fetch })
 
     expect(mount.querySelector('.publisher-badge-admin')).toBeNull()
-    expect(mount.querySelector('.publisher-badge-role')?.textContent).toBe('Publisher')
+    // The retired `publisher` label never surfaces — it renders as Author.
+    expect(mount.querySelector('.publisher-badge-role')?.textContent).toBe('Author')
   })
 
   it('renders an empty affiliation input when affiliation is null', async () => {
diff --git a/src/ui/publisher/pages/me.ts b/src/ui/publisher/pages/me.ts
index e574c5267..43674a796 100644
--- a/src/ui/publisher/pages/me.ts
+++ b/src/ui/publisher/pages/me.ts
@@ -75,18 +75,33 @@ function badge(text: string, kind: 'admin' | 'role' | 'status'): HTMLElement {
   return el('span', `publisher-badge publisher-badge-${kind}`, text)
 }
 
-/** Localize a publisher role. Exported so the sidebar footer reuses
- *  the single source of truth (avoids a drifting second copy). */
+/** Localize a publisher role. Exported so the sidebar footer + Users
+ *  tab reuse the single source of truth (avoids a drifting second
+ *  copy). */
+// Switch on the raw stored string (not the authz-normalized role) so a
+// genuinely unknown / future role shows verbatim rather than being
+// mislabeled as the fail-closed `reviewer` (right for gating, wrong for
+// a human-facing badge). The legacy `publisher` / `readonly` strings
+// render as their canonical labels (Author / Reviewer): the roles were
+// renamed (migration 0039) and the old names are retired, so we never
+// surface them — even while an un-migrated row still carries the legacy
+// string.
 export function localizedRole(role: string): string {
   switch (role) {
     case 'admin':
       return t('publisher.me.role.admin')
-    case 'publisher':
-      return t('publisher.me.role.publisher')
+    case 'editor':
+      return t('publisher.me.role.editor')
+    case 'author':
+    case 'publisher': // legacy alias — role renamed to author
+      return t('publisher.me.role.author')
+    case 'contributor':
+      return t('publisher.me.role.contributor')
+    case 'reviewer':
+    case 'readonly': // legacy alias — role renamed to reviewer
+      return t('publisher.me.role.reviewer')
     case 'service':
       return t('publisher.me.role.service')
-    case 'readonly':
-      return t('publisher.me.role.readonly')
     default:
       return role
   }
diff --git a/src/ui/publisher/pages/tours.test.ts b/src/ui/publisher/pages/tours.test.ts
index 23834276a..ec6a8c013 100644
--- a/src/ui/publisher/pages/tours.test.ts
+++ b/src/ui/publisher/pages/tours.test.ts
@@ -2,6 +2,19 @@ import { describe, expect, it, vi } from 'vitest'
 import { renderToursPage } from './tours'
 import type { TourListItem } from '../../tourAuthoring/api'
 
+/** Minimal `/me` fetch stub returning the given role. */
+function meFetch(role: string) {
+  return vi.fn(async () => ({
+    ok: true,
+    status: 200,
+    type: 'basic',
+    json: async () => ({ role }),
+    text: async () => JSON.stringify({ role }),
+  }) as unknown as Response)
+}
+
+const flush = () => new Promise<void>(r => setTimeout(r, 0))
+
 function makeTour(overrides: Partial<TourListItem> = {}): TourListItem {
   return {
     id: '01HXAAAAAAAAAAAAAAAAAAAAAA',
@@ -31,6 +44,30 @@ describe('renderToursPage (tour/A → /G)', () => {
     expect(content.querySelector('.publisher-empty')?.textContent).toContain('No tours yet')
   })
 
+  it('hides the New-tour button for a reviewer (no content.create)', async () => {
+    const content = document.createElement('div')
+    await renderToursPage(content, {
+      navigate: () => {},
+      createDraft: vi.fn(),
+      listFn: vi.fn(async () => ({ tours: [], next_cursor: null })),
+      fetchFn: meFetch('reviewer'),
+    })
+    await flush()
+    expect(content.querySelector('.publisher-tour-new-btn')).toBeNull()
+  })
+
+  it('keeps the New-tour button for an author (content.create)', async () => {
+    const content = document.createElement('div')
+    await renderToursPage(content, {
+      navigate: () => {},
+      createDraft: vi.fn(),
+      listFn: vi.fn(async () => ({ tours: [], next_cursor: null })),
+      fetchFn: meFetch('author'),
+    })
+    await flush()
+    expect(content.querySelector('.publisher-tour-new-btn')).not.toBeNull()
+  })
+
   it('renders a table of tours when the list has rows', async () => {
     const content = document.createElement('div')
     await renderToursPage(content, {
diff --git a/src/ui/publisher/pages/tours.ts b/src/ui/publisher/pages/tours.ts
index 8c99dcadc..8cefeccfe 100644
--- a/src/ui/publisher/pages/tours.ts
+++ b/src/ui/publisher/pages/tours.ts
@@ -10,7 +10,8 @@
 
 import { fetchFeatures, renderFeatureDisabledCard } from '../features'
 import { t } from '../../../i18n'
-import { clearWarmupFlag, handleSessionError } from '../api'
+import { clearWarmupFlag, handleSessionError, publisherGet } from '../api'
+import { roleCan } from '../../../types/publisher-roles'
 import {
   createDraftTour,
   deleteTour,
@@ -35,8 +36,16 @@ export interface ToursPageOptions {
   /** Confirmation hook — defaults to `window.confirm`. Tests
    *  inject a stub that auto-accepts or auto-cancels. */
   confirm?: (message: string) => boolean
+  /** Injectable for the create-gate's `/me` fetch (tests). */
+  fetchFn?: typeof fetch
 }
 
+interface MeResponse {
+  role: string
+}
+
+const ME_ENDPOINT = '/api/v1/publish/me'
+
 export async function renderToursPage(
   content: HTMLElement,
   options: ToursPageOptions = {},
@@ -83,6 +92,16 @@ export async function renderToursPage(
   content.replaceChildren(
     buildShell(result.tours, navigate, createDraft, del, retract, confirmFn),
   )
+
+  // Creating a tour needs `content.create` (contributor / author /
+  // editor / admin / service). A reviewer can read the list but not
+  // author, so drop the New-tour button rather than let the click 403.
+  // Progressive + fail-open — the server stays the authoritative gate.
+  void publisherGet<MeResponse>(ME_ENDPOINT, { fetchFn: options.fetchFn }).then(res => {
+    if (res.ok && !roleCan(res.data.role, 'content.create')) {
+      content.querySelector('.publisher-tour-new-btn')?.remove()
+    }
+  })
 }
 
 function buildLoadingShell(): HTMLElement {
diff --git a/src/ui/publisher/pages/users.test.ts b/src/ui/publisher/pages/users.test.ts
index 238c8cb06..6584a39bf 100644
--- a/src/ui/publisher/pages/users.test.ts
+++ b/src/ui/publisher/pages/users.test.ts
@@ -74,6 +74,33 @@ describe('renderUsersPage', () => {
     expect(labels).toContain('Reject')
   })
 
+  it('renders the role → capability guide derived from the shared matrix', async () => {
+    const routes = {
+      '/api/v1/publish/me': { body: ME_ADMIN },
+      '/api/v1/publish/publishers': { body: { publishers: [publisher()], next_cursor: null } },
+    }
+    await renderUsersPage(mount, { fetchFn: mockFetch(routes) })
+    const guide = mount.querySelector('.publisher-role-guide')
+    expect(guide).not.toBeNull()
+    // Five assignable-role columns, least → most privileged.
+    const cols = Array.from(guide!.querySelectorAll('thead th')).map(th => th.textContent)
+    expect(cols).toEqual(['Can', 'Reviewer', 'Contributor', 'Author', 'Editor', 'Admin'])
+
+    // Reviewer (col index 1 → cell 0 after the row header) is read-only:
+    // only the first capability row ("Read…") is granted.
+    const rows = Array.from(guide!.querySelectorAll('tbody tr'))
+    const reviewerCells = rows.map(r => r.querySelectorAll('td')[0])
+    expect(reviewerCells[0].classList.contains('publisher-role-guide-yes')).toBe(true) // read
+    expect(reviewerCells.slice(1).every(c => !c.classList.contains('publisher-role-guide-yes'))).toBe(true)
+
+    // Admin (last column) grants every listed capability.
+    const adminCells = rows.map(r => {
+      const tds = r.querySelectorAll('td')
+      return tds[tds.length - 1]
+    })
+    expect(adminCells.every(c => c.classList.contains('publisher-role-guide-yes'))).toBe(true)
+  })
+
   it('approves a pending publisher via PATCH and updates the badge', async () => {
     const routes = {
       '/api/v1/publish/me': { body: ME_ADMIN },
diff --git a/src/ui/publisher/pages/users.ts b/src/ui/publisher/pages/users.ts
index 878a3361e..f6556c85d 100644
--- a/src/ui/publisher/pages/users.ts
+++ b/src/ui/publisher/pages/users.ts
@@ -5,7 +5,13 @@
  * publisher accounts with a status filter and lets an admin:
  *   - approve / reject a pending account,
  *   - suspend / reactivate,
- *   - change role (promote to admin, demote to publisher, read-only).
+ *   - change role across the five assignable tiers (admin / editor /
+ *     author / contributor / reviewer).
+ *
+ * A collapsible role → capability guide (`buildRoleGuide`, rendered
+ * from the shared matrix in `src/types/publisher-roles.ts`) sits at the
+ * top so an admin can see exactly what a role grants before assigning
+ * it.
  *
  * Mutations go through `PATCH /api/v1/publish/publishers/{id}` via the
  * shared `publisherSend` helper, which surfaces validation (the
@@ -25,6 +31,14 @@ import {
 } from '../api'
 import { buildErrorCard } from '../components/error-card'
 import { initialsOf } from '../components/sidebar'
+import { localizedRole } from './me'
+import {
+  ASSIGNABLE_ROLES,
+  normalizeRole,
+  roleCan,
+  type Capability,
+  type Role,
+} from '../../../types/publisher-roles'
 import type { ListPublishersResponse, PublisherSummary, UpdatePublisherPayload } from '../types'
 
 const ME_ENDPOINT = '/api/v1/publish/me'
@@ -57,19 +71,92 @@ function shell(...children: HTMLElement[]): HTMLElement {
   return main
 }
 
-function localizedRole(role: string): string {
-  switch (role) {
-    case 'admin':
-      return t('publisher.me.role.admin')
-    case 'publisher':
-      return t('publisher.me.role.publisher')
-    case 'service':
-      return t('publisher.me.role.service')
-    case 'readonly':
-      return t('publisher.me.role.readonly')
-    default:
-      return role
+// Decorative grant/deny glyphs — each cell also carries a translated
+// aria-label so the yes/no reaches assistive tech.
+const YES_GLYPH = '✓' // i18n-exempt: decorative; aria-label carries the meaning
+const NO_GLYPH = '·' // i18n-exempt: decorative; aria-label carries the meaning
+
+// Assignable roles ordered least → most privileged so the guide reads
+// as a cumulative ladder (each column can do everything the ones before
+// it can, plus more — the matrix is strictly monotonic).
+const ROLE_GUIDE_COLUMNS: readonly Role[] = ['reviewer', 'contributor', 'author', 'editor', 'admin']
+
+// One display row per meaningful distinction, keyed to a representative
+// capability. Rendered straight from `roleCan` against the shared
+// matrix, so this guide can never drift from what the server enforces.
+const ROLE_GUIDE_ROWS = [
+  { cap: 'content.read', labelKey: 'publisher.team.roleGuide.cap.read' },
+  { cap: 'content.create', labelKey: 'publisher.team.roleGuide.cap.create' },
+  { cap: 'content.edit.own', labelKey: 'publisher.team.roleGuide.cap.editOwn' },
+  { cap: 'content.publish.own', labelKey: 'publisher.team.roleGuide.cap.publishOwn' },
+  { cap: 'content.publish.any', labelKey: 'publisher.team.roleGuide.cap.editAny' },
+  { cap: 'hero.manage', labelKey: 'publisher.team.roleGuide.cap.hero' },
+  { cap: 'operator.manage', labelKey: 'publisher.team.roleGuide.cap.operator' },
+  { cap: 'users.manage', labelKey: 'publisher.team.roleGuide.cap.users' },
+] as const satisfies ReadonlyArray<{ cap: Capability; labelKey: Parameters<typeof t>[0] }>
+
+/** Collapsible "what each role can do" reference, mounted at the top of
+ *  the Team tab so an admin sees exactly what a role grants before
+ *  assigning it. Built from the shared capability matrix. */
+function buildRoleGuide(): HTMLElement {
+  const details = document.createElement('details')
+  details.className = 'publisher-role-guide'
+
+  const summary = document.createElement('summary')
+  summary.className = 'publisher-role-guide-summary'
+  summary.textContent = t('publisher.team.roleGuide.title')
+  details.appendChild(summary)
+
+  const intro = document.createElement('p')
+  intro.className = 'publisher-role-guide-intro'
+  intro.textContent = t('publisher.team.roleGuide.intro')
+  details.appendChild(intro)
+
+  const wrap = document.createElement('div')
+  wrap.className = 'publisher-table-wrap'
+  const table = document.createElement('table')
+  table.className = 'publisher-table publisher-role-guide-table'
+
+  const thead = document.createElement('thead')
+  const headRow = document.createElement('tr')
+  const capHead = document.createElement('th')
+  capHead.scope = 'col'
+  capHead.textContent = t('publisher.team.roleGuide.capHeader')
+  headRow.appendChild(capHead)
+  for (const role of ROLE_GUIDE_COLUMNS) {
+    const th = document.createElement('th')
+    th.scope = 'col'
+    th.textContent = localizedRole(role)
+    headRow.appendChild(th)
   }
+  thead.appendChild(headRow)
+  table.appendChild(thead)
+
+  const tbody = document.createElement('tbody')
+  for (const row of ROLE_GUIDE_ROWS) {
+    const tr = document.createElement('tr')
+    const rowHead = document.createElement('th')
+    rowHead.scope = 'row'
+    rowHead.textContent = t(row.labelKey)
+    tr.appendChild(rowHead)
+    for (const role of ROLE_GUIDE_COLUMNS) {
+      const td = document.createElement('td')
+      td.className = 'publisher-role-guide-cell'
+      const granted = roleCan(role, row.cap)
+      if (granted) td.classList.add('publisher-role-guide-yes')
+      td.textContent = granted ? YES_GLYPH : NO_GLYPH
+      td.setAttribute(
+        'aria-label',
+        t(granted ? 'publisher.team.roleGuide.yes' : 'publisher.team.roleGuide.no'),
+      )
+      tr.appendChild(td)
+    }
+    tbody.appendChild(tr)
+  }
+  table.appendChild(tbody)
+  wrap.appendChild(table)
+  details.appendChild(wrap)
+  return details
 }
 
 function localizedStatus(status: string): string {
@@ -196,6 +283,10 @@ function renderList(
   header.appendChild(inviteWrap)
   root.appendChild(header)
 
+  // Role reference — collapsible so it stays out of the way, but on
+  // hand when an admin is deciding which role to assign.
+  root.appendChild(buildRoleGuide())
+
   // Status filter tabs — navigate by ?status= so the view is
   // bookmarkable, mirroring the datasets page.
   const tabs = document.createElement('nav')
@@ -310,11 +401,12 @@ function renderRow(
     const select = document.createElement('select')
     select.className = 'publisher-users-role-select'
     if (isSelf) select.disabled = true
-    for (const r of ['admin', 'publisher', 'readonly'] as const) {
+    const currentRole = normalizeRole(publisher.role)
+    for (const r of ASSIGNABLE_ROLES) {
       const opt = document.createElement('option')
       opt.value = r
       opt.textContent = localizedRole(r)
-      if (r === publisher.role) opt.selected = true
+      if (r === currentRole) opt.selected = true
       select.appendChild(opt)
     }
     select.addEventListener('change', () => {
diff --git a/src/ui/publisher/types.ts b/src/ui/publisher/types.ts
index 9ed1790ef..5d1aa0099 100644
--- a/src/ui/publisher/types.ts
+++ b/src/ui/publisher/types.ts
@@ -47,6 +47,18 @@ export interface PublisherDataset {
    *  for a thumbnail cell in the list table. Null/absent when there's
    *  no thumbnail or it can't be resolved (no R2 public base bound). */
   thumbnail_url?: string | null
+  /** Whether the current caller may mutate this row (edit / retract /
+   *  delete). The whole catalog is visible to every publisher, but
+   *  writes stay owner-scoped, so the portal only shows the mutation
+   *  controls when this is true. Absent on older payloads / fixtures,
+   *  which the UI treats as editable (`can_edit !== false`) since the
+   *  server is the authoritative gate regardless of what the UI
+   *  shows. */
+  can_edit?: boolean
+  /** Whether the caller may publish/retract this row (author-own or
+   *  editor/admin-any). Distinct from `can_edit`: a contributor edits
+   *  its own draft but can't publish it. Absent → treated as allowed. */
+  can_publish?: boolean
 }
 
 /**
diff --git a/src/ui/tourAuthoring/api.ts b/src/ui/tourAuthoring/api.ts
index 22e285621..18d498150 100644
--- a/src/ui/tourAuthoring/api.ts
+++ b/src/ui/tourAuthoring/api.ts
@@ -262,8 +262,21 @@ function errorLabel(
       return 'Session expired — please sign in again'
     case 'not_found':
       return 'Tour not found'
-    case 'server':
-      return result.body || `Server error (${result.status ?? 'unknown'})`
+    case 'server': {
+      // The API sends `{ error, message }`; surface the human-readable
+      // message, never the raw JSON envelope (a 403 for a reviewer was
+      // rendering `{"error":"forbidden_role","message":"…"}` verbatim).
+      if (result.body) {
+        try {
+          const parsed = JSON.parse(result.body) as { message?: unknown }
+          if (typeof parsed.message === 'string' && parsed.message.trim()) return parsed.message
+        } catch {
+          // Not JSON — fall through to the raw body.
+        }
+        return result.body
+      }
+      return `Server error (${result.status ?? 'unknown'})`
+    }
     case 'validation':
       return result.errors[0]?.message ?? 'Validation failed'
   }