-- Bell runtime may append global audit facts and maintain only short-lived
-- idempotency receipts. Sense keeps ownership of its local Outbox.

REVOKE ALL ON TABLE bell.audit_events, bell.audit_relay_receipts FROM PUBLIC;
REVOKE ALL ON TABLE bell.audit_events, bell.audit_relay_receipts FROM bell_runtime;

GRANT SELECT, INSERT ON TABLE bell.audit_events TO bell_runtime;
GRANT SELECT, INSERT, DELETE ON TABLE bell.audit_relay_receipts TO bell_runtime;

REVOKE ALL ON TABLE bell.audit_events, bell.audit_relay_receipts FROM sense_app;
GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE sense.device_operation_outbox TO sense_app;