Role defaults are rows the workspace may remove

Context

Default holders should work immediately while allowing organizations to remove them.

Decision

Materialize declared role defaults as workspace holdings and retain removed defaults so reconciliation does not recreate them.

Alternatives Considered

Resolve defaults directly from declarations: Direct declaration reads would make workspace removal ineffective.

Create a holding for every role member: Membership changes would require rewriting many holdings.

Consequences

First use, registration and overnight work initialize defaults. Removed rows remain as reconciliation exclusions. A more specific resource holding can take precedence at that scope.