Type Alias SystemUserFieldAccessSweepOptions

Evaluate as though the system user did NOT hold this role.

For the guard on removing a role from the account: taking a role away removes its rules from the aggregate, which can strip the last Allow just as surely as editing one. Both the field rules and the entity-level ceiling are re-evaluated without it, so a removal that also costs the account its entity-level read is correctly permitted — it is then denied one level up, and field rules decide nothing.