diff --git a/README.md b/README.md
index 931d252c4..aeb2ab109 100644
--- a/README.md
+++ b/README.md
@@ -77,7 +77,7 @@ Captured from this machine to document the local development environment:
 
 ## Key Highlights
 
-- **5-Level Permission System**: Each user level from Public to SuperGod maps to documented routes, policies, and role inheritance so you can reason about features before touching code ([`docs/architecture/5-level-system.md`](./docs/architecture/5-level-system.md)).
+- **6-Level Permission System**: Each user level from Public to SuperGod maps to documented routes, policies, and role inheritance so you can reason about features before touching code ([`docs/architecture/5-level-system.md`](./docs/architecture/5-level-system.md)).
 - **Multi-tenant data platform**: Prisma, tenant-aware storage, and quota management patterns keep all queries scoped by `tenantId` while keeping schema evolution safe ([`docs/architecture/database.md`](./docs/architecture/database.md)).
 - **Declarative packages & Lua logic**: Modular `packages/*/seed` definitions let you ship UI/features via JSON/Lua, while the Lua sandbox protects the runtime ([`docs/architecture/packages.md`](./docs/architecture/packages.md), [`docs/lua/README.md`](./docs/lua/README.md)).
 - **Type-safe + CI-ready workflow**: TypeScript tooling, Act local workflows, and targeted scripts keep linting, testing, and deploy checks consistent with the documentation hub ([`docs/README.md`](./docs/README.md)).
diff --git a/frontends/nextjs/src/lib/lua/functions/sandbox/destroy.ts b/frontends/nextjs/src/lib/lua/functions/sandbox/execution/destroy.ts
similarity index 100%
rename from frontends/nextjs/src/lib/lua/functions/sandbox/destroy.ts
rename to frontends/nextjs/src/lib/lua/functions/sandbox/execution/destroy.ts
diff --git a/frontends/nextjs/src/lib/lua/functions/sandbox/execute-with-sandbox.ts b/frontends/nextjs/src/lib/lua/functions/sandbox/execution/execute-with-sandbox.ts
similarity index 100%
rename from frontends/nextjs/src/lib/lua/functions/sandbox/execute-with-sandbox.ts
rename to frontends/nextjs/src/lib/lua/functions/sandbox/execution/execute-with-sandbox.ts
diff --git a/frontends/nextjs/src/lib/lua/functions/sandbox/execute-with-timeout.ts b/frontends/nextjs/src/lib/lua/functions/sandbox/execution/execute-with-timeout.ts
similarity index 100%
rename from frontends/nextjs/src/lib/lua/functions/sandbox/execute-with-timeout.ts
rename to frontends/nextjs/src/lib/lua/functions/sandbox/execution/execute-with-timeout.ts
diff --git a/frontends/nextjs/src/lib/lua/functions/sandbox/set-execution-timeout.ts b/frontends/nextjs/src/lib/lua/functions/sandbox/execution/set-execution-timeout.ts
similarity index 100%
rename from frontends/nextjs/src/lib/lua/functions/sandbox/set-execution-timeout.ts
rename to frontends/nextjs/src/lib/lua/functions/sandbox/execution/set-execution-timeout.ts
diff --git a/frontends/nextjs/src/lib/lua/functions/sandbox/disable-dangerous-functions.ts b/frontends/nextjs/src/lib/lua/functions/sandbox/execution/setup/disable-dangerous-functions.ts
similarity index 100%
rename from frontends/nextjs/src/lib/lua/functions/sandbox/disable-dangerous-functions.ts
rename to frontends/nextjs/src/lib/lua/functions/sandbox/execution/setup/disable-dangerous-functions.ts
diff --git a/frontends/nextjs/src/lib/lua/functions/sandbox/setup-sandboxed-environment.ts b/frontends/nextjs/src/lib/lua/functions/sandbox/execution/setup/setup-sandboxed-environment.ts
similarity index 100%
rename from frontends/nextjs/src/lib/lua/functions/sandbox/setup-sandboxed-environment.ts
rename to frontends/nextjs/src/lib/lua/functions/sandbox/execution/setup/setup-sandboxed-environment.ts
diff --git a/frontends/nextjs/src/lib/lua/functions/sandbox/default-allowed-globals.ts b/frontends/nextjs/src/lib/lua/functions/sandbox/globals/default-allowed-globals.ts
similarity index 100%
rename from frontends/nextjs/src/lib/lua/functions/sandbox/default-allowed-globals.ts
rename to frontends/nextjs/src/lib/lua/functions/sandbox/globals/default-allowed-globals.ts
diff --git a/frontends/nextjs/src/lib/lua/functions/sandbox/normalize-allowed-globals.test.ts b/frontends/nextjs/src/lib/lua/functions/sandbox/globals/normalize-allowed-globals.test.ts
similarity index 100%
rename from frontends/nextjs/src/lib/lua/functions/sandbox/normalize-allowed-globals.test.ts
rename to frontends/nextjs/src/lib/lua/functions/sandbox/globals/normalize-allowed-globals.test.ts
diff --git a/frontends/nextjs/src/lib/lua/functions/sandbox/normalize-allowed-globals.ts b/frontends/nextjs/src/lib/lua/functions/sandbox/globals/normalize-allowed-globals.ts
similarity index 100%
rename from frontends/nextjs/src/lib/lua/functions/sandbox/normalize-allowed-globals.ts
rename to frontends/nextjs/src/lib/lua/functions/sandbox/globals/normalize-allowed-globals.ts
diff --git a/frontends/nextjs/src/lib/lua/functions/sandbox/set-allowed-globals.ts b/frontends/nextjs/src/lib/lua/functions/sandbox/globals/set-allowed-globals.ts
similarity index 100%
rename from frontends/nextjs/src/lib/lua/functions/sandbox/set-allowed-globals.ts
rename to frontends/nextjs/src/lib/lua/functions/sandbox/globals/set-allowed-globals.ts
diff --git a/frontends/nextjs/src/lib/lua/functions/sandbox/enforce-max-memory.test.ts b/frontends/nextjs/src/lib/lua/functions/sandbox/memory/enforce-max-memory.test.ts
similarity index 100%
rename from frontends/nextjs/src/lib/lua/functions/sandbox/enforce-max-memory.test.ts
rename to frontends/nextjs/src/lib/lua/functions/sandbox/memory/enforce-max-memory.test.ts
diff --git a/frontends/nextjs/src/lib/lua/functions/sandbox/enforce-max-memory.ts b/frontends/nextjs/src/lib/lua/functions/sandbox/memory/enforce-max-memory.ts
similarity index 100%
rename from frontends/nextjs/src/lib/lua/functions/sandbox/enforce-max-memory.ts
rename to frontends/nextjs/src/lib/lua/functions/sandbox/memory/enforce-max-memory.ts
diff --git a/frontends/nextjs/src/lib/lua/functions/sandbox/get-lua-memory-usage-bytes.ts b/frontends/nextjs/src/lib/lua/functions/sandbox/memory/get-lua-memory-usage-bytes.ts
similarity index 100%
rename from frontends/nextjs/src/lib/lua/functions/sandbox/get-lua-memory-usage-bytes.ts
rename to frontends/nextjs/src/lib/lua/functions/sandbox/memory/get-lua-memory-usage-bytes.ts