-- Live query (run before this migration) found Kenn and Bjorn have no
-- 'invoicing' permissions row at all, despite the confirmed target
-- state: both should be invoice reviewers (can_view=true, can_write=
-- false) — view-only, same as C3_SPEC's documented roster (Kenn:
-- "invoice reviewer (view only)"; Bjorn: "invoice reviewer", flagged
-- separately re: whether info@khaizen.eu is really his personal
-- inbox, unrelated to this grant). Matches the exact grant pattern
-- migration 0020 used for Dominic/Andrew (rate_and_schedule).
insert into public.permissions (user_id, feature_key, can_view, can_write) values
  ('c5bc18b2-99ac-4c8d-b8c0-7b49273c5719', 'invoicing', true, false), -- Kenn
  ('2a60b0c9-c88a-4e08-b10f-6cf50f12ce63', 'invoicing', true, false)  -- Bjorn
on conflict (user_id, feature_key) do update
  set can_view = true, can_write = false;