graph TD
    subgraph "Service Accounts"
        SA_CM["controller-manager<br/>(operator namespace)"]
        SA_Inst["{instance}-sa<br/>(workload namespace)"]
    end

    subgraph "Role Bindings"
        CRB_Inst["{instance}-crb<br/>(cluster-scoped)"]
        RB_Leader["leader-election-rolebinding<br/>(operator namespace)"]
    end

    subgraph "Roles"
        CR_Manager["ClusterRole:<br/>manager-role"]
        CR_SCC["ClusterRole:<br/>system:openshift:scc:anyuid"]
        R_Leader["Role:<br/>leader-election-role"]
    end

    subgraph "llamastack.io API Resources"
        LLSD["llamastack.io<br/>llamastackdistributions"]
        LLSDStatus["llamastack.io<br/>llamastackdistributions/status"]
        LLSDFinalizers["llamastack.io<br/>llamastackdistributions/finalizers"]
    end

    subgraph "apps API Resources"
        Deployments["apps<br/>deployments"]
    end

    subgraph "Core API Resources"
        Services["core<br/>services"]
        ServiceAccounts["core<br/>serviceaccounts"]
        PVCs["core<br/>persistentvolumeclaims"]
        ConfigMaps["core<br/>configmaps"]
    end

    subgraph "networking.k8s.io API Resources"
        NetworkPolicies["networking.k8s.io<br/>networkpolicies"]
        Ingresses["networking.k8s.io<br/>ingresses"]
    end

    subgraph "rbac.authorization.k8s.io API Resources"
        ClusterRoleBindings["rbac.authorization.k8s.io<br/>clusterrolebindings"]
        ClusterRoles["rbac.authorization.k8s.io<br/>clusterroles"]
    end

    subgraph "security.openshift.io API Resources"
        SCCs["security.openshift.io<br/>securitycontextconstraints"]
    end

    %% Operator SA bindings
    SA_CM -->|"bound via (implicit)"| CR_Manager
    SA_CM -->|"bound via"| RB_Leader
    RB_Leader -->|"grants"| R_Leader

    %% Instance SA bindings
    SA_Inst -->|"bound via"| CRB_Inst
    CRB_Inst -->|"grants"| CR_SCC

    %% manager-role permissions
    CR_Manager -->|"get, list, watch,<br/>create, update, patch, delete"| LLSD
    CR_Manager -->|"get, patch, update"| LLSDStatus
    CR_Manager -->|"update"| LLSDFinalizers
    CR_Manager -->|"get, list, watch,<br/>create, update, patch, delete"| Deployments
    CR_Manager -->|"get, list, watch,<br/>create, update, patch, delete"| Services
    CR_Manager -->|"get, list, watch,<br/>create, update, patch, delete"| ServiceAccounts
    CR_Manager -->|"get, list, watch, create"| PVCs
    CR_Manager -->|"get, list, watch,<br/>create, update, patch"| ConfigMaps
    CR_Manager -->|"get, list, watch,<br/>create, update, patch, delete"| NetworkPolicies
    CR_Manager -->|"get, list, watch,<br/>create, update, patch, delete"| Ingresses
    CR_Manager -->|"get, list, watch,<br/>create, update, patch, delete"| ClusterRoleBindings
    CR_Manager -->|"get, list, watch"| ClusterRoles
    CR_Manager -->|"use"| SCCs

    style SA_CM fill:#4a90e2,stroke:#333,color:#fff
    style SA_Inst fill:#4a90e2,stroke:#333,color:#fff
    style CR_Manager fill:#f5a623,stroke:#333,color:#fff
    style CR_SCC fill:#f5a623,stroke:#333,color:#fff
    style R_Leader fill:#f5a623,stroke:#333,color:#fff
    style CRB_Inst fill:#e8e8e8,stroke:#333
    style RB_Leader fill:#e8e8e8,stroke:#333
    style LLSD fill:#7ed321,stroke:#333,color:#fff
    style LLSDStatus fill:#7ed321,stroke:#333,color:#fff
    style LLSDFinalizers fill:#7ed321,stroke:#333,color:#fff
    style Deployments fill:#7ed321,stroke:#333,color:#fff
    style Services fill:#7ed321,stroke:#333,color:#fff
    style ServiceAccounts fill:#7ed321,stroke:#333,color:#fff
    style PVCs fill:#7ed321,stroke:#333,color:#fff
    style ConfigMaps fill:#7ed321,stroke:#333,color:#fff
    style NetworkPolicies fill:#7ed321,stroke:#333,color:#fff
    style Ingresses fill:#7ed321,stroke:#333,color:#fff
    style ClusterRoleBindings fill:#7ed321,stroke:#333,color:#fff
    style ClusterRoles fill:#7ed321,stroke:#333,color:#fff
    style SCCs fill:#7ed321,stroke:#333,color:#fff
