diff --git a/dbal/ts/src/core/entities/lua-script/delete-lua-script.ts b/dbal/ts/src/core/entities/lua-script/delete-lua-script.ts
index 6eae1b45a..4aaf7bc2c 100644
--- a/dbal/ts/src/core/entities/lua-script/delete-lua-script.ts
+++ b/dbal/ts/src/core/entities/lua-script/delete-lua-script.ts
@@ -2,22 +2,25 @@
  * @file delete-lua-script.ts
  * @description Delete Lua script operation
  */
-import type { Result } from '../types';
-import type { InMemoryStore } from '../store/in-memory-store';
+import type { DBALAdapter } from '../../../adapters/adapter'
+import { DBALError } from '../../errors'
+import { validateId } from '../../validation'
 
 /**
  * Delete a Lua script by ID
  */
-export async function deleteLuaScript(store: InMemoryStore, id: string): Promise<Result<boolean>> {
-  if (!id) {
-    return { success: false, error: { code: 'VALIDATION_ERROR', message: 'ID required' } };
+export async function deleteLuaScript(adapter: DBALAdapter, id: string): Promise<boolean> {
+  const validationErrors = validateId(id)
+  if (validationErrors.length > 0) {
+    throw DBALError.validationError(
+      'Invalid Lua script ID',
+      validationErrors.map(error => ({ field: 'id', error }))
+    )
   }
 
-  const script = store.luaScripts.get(id);
-  if (!script) {
-    return { success: false, error: { code: 'NOT_FOUND', message: `Lua script not found: ${id}` } };
+  const result = await adapter.delete('LuaScript', id)
+  if (!result) {
+    throw DBALError.notFound(`Lua script not found: ${id}`)
   }
-
-  store.luaScripts.delete(id);
-  return { success: true, data: true };
+  return result
 }
diff --git a/docs/todo/21-SDLC-TODO.md b/docs/todo/21-SDLC-TODO.md
index 6a6c06d02..94a529c81 100644
--- a/docs/todo/21-SDLC-TODO.md
+++ b/docs/todo/21-SDLC-TODO.md
@@ -42,6 +42,7 @@
 
 ### Development Scripts
 - [x] Add Codegen Studio export verification script (`tools/validate-codegen-export.ts`)
+- [x] Add permission level catalog script (`tools/list-permissions.ts`)
 
 ---
 
diff --git a/frontends/nextjs/src/lib/lua/functions/sandbox/set-allowed-globals.ts b/frontends/nextjs/src/lib/lua/functions/sandbox/set-allowed-globals.ts
new file mode 100644
index 000000000..b1bafad28
--- /dev/null
+++ b/frontends/nextjs/src/lib/lua/functions/sandbox/set-allowed-globals.ts
@@ -0,0 +1,9 @@
+import type { SandboxedLuaEngineState } from './types'
+import { normalizeAllowedGlobals } from './normalize-allowed-globals'
+
+export function setAllowedGlobals(
+  this: SandboxedLuaEngineState,
+  allowedGlobals?: string[]
+): void {
+  this.allowedGlobals = normalizeAllowedGlobals(allowedGlobals)
+}
diff --git a/frontends/nextjs/src/lib/lua/functions/sandbox/types.ts b/frontends/nextjs/src/lib/lua/functions/sandbox/types.ts
index 1a6481076..d3f974adf 100644
--- a/frontends/nextjs/src/lib/lua/functions/sandbox/types.ts
+++ b/frontends/nextjs/src/lib/lua/functions/sandbox/types.ts
@@ -17,10 +17,14 @@ export interface SandboxedLuaEngineState {
   executionTimeout: number
   /** Maximum memory allowed */
   maxMemory: number
+  /** Allowed global names for sandbox */
+  allowedGlobals?: string[]
+  /** Set allowed global names for sandbox */
+  setAllowedGlobals: (allowedGlobals?: string[]) => void
   /** Disable dangerous Lua functions */
   disableDangerousFunctions: () => void
   /** Setup sandboxed environment */
-  setupSandboxedEnvironment: () => void
+  setupSandboxedEnvironment: (allowedGlobals?: string[]) => void
   /** Execute code with timeout */
   executeWithTimeout: (code: string, context?: LuaExecutionContext) => Promise<LuaExecutionResult>
   /** Read current Lua heap usage in bytes */
diff --git a/packages/codegen_studio/static_content/cli/main.cpp b/packages/codegen_studio/static_content/cli/main.cpp
index 58b25400b..366b940ae 100644
--- a/packages/codegen_studio/static_content/cli/main.cpp
+++ b/packages/codegen_studio/static_content/cli/main.cpp
@@ -1,5 +1,6 @@
 #include <iostream>
 #include <string>
+#include <string_view>
 
 struct ProjectSpec {
   std::string projectName{"starter-app"};
@@ -35,7 +36,38 @@ static void printSpec(const ProjectSpec& spec) {
   std::cout << "Zip includes Next.js + CLI stubs." << std::endl;
 }
 
+struct PermissionLevelInfo {
+  int id;
+  const char* title;
+  const char* description;
+  const char* capabilities;
+};
+
+static constexpr PermissionLevelInfo permissionLevels[] = {
+  {1, "Guest", "Read public marketing and landing pages.", "Access front page · View news feed · Browse docs"},
+  {2, "Regular User", "Customize profile, dashboards, and personal settings.", "Update profile · Save dashboards · Post comments"},
+  {3, "Moderator", "Triage reports, resolve flags, and keep the community civil.", "Review reports · Moderate threads · Apply warnings"},
+  {4, "God", "Design workflows, seed packages, and edit the front page.", "Edit architecture · Seed packages · Define workflows"},
+  {5, "Super God", "Transfer ownership, audit the system, and override safeguards.", "Promote gods · Transfer rights · Run audits"},
+};
+
+static void printLevels() {
+  std::cout << "Permission levels inventory:" << std::endl;
+  for (const auto& level : permissionLevels) {
+    std::cout << "Level " << level.id << " · " << level.title << std::endl;
+    std::cout << "  " << level.description << std::endl;
+    std::cout << "  Capabilities: " << level.capabilities << std::endl;
+  }
+}
+
 int main(int argc, char** argv) {
+  for (int i = 1; i < argc; ++i) {
+    if (std::string_view(argv[i]) == "--levels") {
+      printLevels();
+      return 0;
+    }
+  }
+
   const auto spec = parseSpec(argc, argv);
   printSpec(spec);
   std::cout << "- " << spec.projectName << "/README.md" << std::endl;