The snowflake-mode access roster.

Which ACCOUNT roles hold each dvt APPLICATION role — who can reach dvt and at what tier (the /admin Roles tab). Snowflake mode only: outside it (or off the Snowflake ingress path) this route does not exist (404). Admin or owner only (audit:read), and the path orgId must be the caller's own org — this is the install's full access map, the same posture as the analytics family. Role names are returned exactly as Snowflake stores them (never case-folded). unreadable lists tiers whose grants could not be read — NOT tiers with no grantees; a client must never render the two the same way. account_roles carries the full account-role enumeration when the app's owner's-rights identity can perform it (runtime-detected per consumer account); when available is false the enumeration is absent and clients degrade to the tier-first roster.