Type Alias SystemUserFieldAccessSweepOptions

The rules to judge each field by, keyed by lower-case EntityFieldID, in place of the rules on loaded metadata. For callers that read the rules from the database because loaded metadata may lag a write made a moment ago. A field absent from the map has no rule for any role the system user holds, so only rules bound to those roles need to be in it.

Evaluate as though the system user did NOT hold this role.

For the guard on removing a role from the account: taking a role away removes its rules from the aggregate, which can strip the last Allow just as surely as editing one. Both the field rules and the entity-level ceiling are re-evaluated without it, so a removal that also costs the account its entity-level read is correctly permitted — it is then denied one level up, and field rules decide nothing.