Live catalog permission state within the managed scope, keyed
<schema>.<object> (lowercased) → entries. Only rows granted to managed roles are
captured; DBA-owned grants to anything else are invisible here and therefore never
touched.
RoleID → SQLName for resolving EntityFieldPermission rows (which carry only RoleID).
SQLNames (lowercased) of roles that a protected principal — the API service login(s) and the CodeGen login — is a MEMBER of. A column DENY emitted to such a role would strip the column from the service login itself (DENY beats every sibling GRANT), so emission SKIPS these roles with a prominent warning instead.
Once-per-run context for field-level-security DB-tier emission and permission reconciliation, computed by the orchestrator (async catalog reads) and handed to the provider whose emitters are synchronous string builders.