docs: add permissions section to project status and clarify future support for custom start functions (#278)

functions

- Updated project status to include information about permissions and upcoming features
- Clarified that pgflow currently has no built-in permissions and requires manual database
configuration
- Mentioned future support for custom start functions to enable authorization and multi-tenant
scenarios in the TypeScript Client

Author: jumski

pkgs/website/src/content/docs/project-status.mdx

@@ -12,19 +12,21 @@ pgflow is in **public beta** and being used in production by early adopters. Cor
 
 ## Known Limitations & Active Work
 
-<CardGrid>
-  <Card title="Performance" icon="rocket">
-    Core operations are optimized with batching, proper indexing, and declarative SQL. However, **large-scale workloads** may reveal additional optimization opportunities. Start with your expected workload and scale as needed.
-  </Card>
+<Card title="Performance" icon="rocket">
+  Core operations are optimized with batching, proper indexing, and declarative SQL. However, **large-scale workloads** may reveal additional optimization opportunities. Start with your expected workload and scale as needed.
+</Card>
 
-  <Card title="Worker Management" icon="setting">
-    Edge Functions have platform execution time limits. For production reliability, set up a **pg_cron job** to automatically restart workers when needed. See [deployment guide](/deploy/supabase/keep-workers-running/) for the simple 2-minute setup.
-  </Card>
+<Card title="Worker Management" icon="setting">
+  Edge Functions have platform execution time limits. For production reliability, set up a **pg_cron job** to automatically restart workers when needed. See [deployment guide](/deploy/supabase/keep-workers-running/) for the simple 2-minute setup.
+</Card>
 
-  <Card title="Fair Processing" icon="warning">
-    Fair processing across flows is not currently implemented. A flow with many tasks (especially map steps processing large arrays) can fill the queue ahead of other flows. This is more noticeable with the introduction of map steps in 0.7.0. For multi-tenant or multi-flow scenarios where fairness is important, join [Discord](https://pgflow.dev/discord/) to discuss approaches and workarounds.
-  </Card>
-</CardGrid>
+<Card title="Fair Processing" icon="warning">
+  Fair processing across flows is not currently implemented. A flow with many tasks (especially map steps processing large arrays) can fill the queue ahead of other flows. This is more noticeable with the introduction of map steps in 0.7.0. For multi-tenant or multi-flow scenarios where fairness is important, join [Discord](https://pgflow.dev/discord/) to discuss approaches and workarounds.
+</Card>
+
+<Card title="Permissions" icon="approve-check">
+  pgflow ships with zero built-in permissions or access controls. [Database permissions](/reference/permissions/) must be manually configured when using the TypeScript Client or Supabase RPC from client applications. In a future release, pgflow will support custom start functions for the TypeScript Client, enabling authorization logic at the database level and supporting multi-tenant scenarios.
+</Card>
 
 ## Breaking Changes
 

pkgs/website/src/content/docs/reference/permissions.mdx

@@ -85,7 +85,7 @@ supabase migration up
 
 With **[Supabase RPC](/build/starting-flows/supabase-rpc/)**, you have full control - wrap `pgflow.start_flow` in your own database functions to implement custom permissions and security logic.
 
-In a future release, pgflow will support **custom start functions** for the TypeScript Client, allowing you to implement authorization logic at the database level.
+In a future release, pgflow will support **custom start functions** for the TypeScript Client, allowing you to implement authorization logic at the database level and enabling multi-tenant scenarios where runs can be associated with specific users or tenants.
 
 ## Learn More