Governance
Roles, permissions, assignments, teams and capabilities, as records.
Governance
The governance world shows what a scope governs itself with, as records: Roles (and how many permissions each grants), Permissions (the product's permission vocabulary, with how many roles grant each), Assignments (who holds which role, where and since when), Teams and their People, and Capabilities. Its links are walkable: a role grants its permissions, an assignment is of role its role, a team has member its people.
Each column is decided with its own key at the scope you are in: roles, permissions and assignments need role.read, teams and people team.read, capabilities capability.read. A column you cannot read is left out, and the bar says which one and the key it needs. What each column holds depends on the scope: at the platform, the global roles and the platform's own capabilities (no assignments, which are held in an account or a tenant, and no teams, which belong to one tenant); at an account, its roles and every assignment inside it and its tenants, and its own capabilities; in a tenant, its roles and assignments, its teams, and the published capabilities it can turn on.
Keep in mind The governance world is read only. Each column's footer links to the screen it is edited in: Roles, Teams, the Capability Studio, the account Studio or Capabilities.