Dashboard widget (a dashboard:widgets plugin): the users & access snapshot — the total user count with a Tenant/Master split, the permission catalogue (defined vs never-assigned) and how many users actually carry grants (with/without, plus the admins: holders of *, admin:* or anything under a surface, a single area included). It is the user area's card, admin:dashboard:user. Everything is counted through the MishkaCmsCore.Accounts.User and MishkaCmsCore.Accounts.Permission resources' tenancy-bypassing reads via Ash.count!/2. A master counts every user; a tenant admin only their own site's users.

Permission has no site_id, so "defined" is a catalogue count — deployment configuration every admin needs in order to grant any of them — and stays global for both. "Unused" does not: it is derived from who holds a permission, which is tenant data, so for a tenant it means held by nobody on this site.

The access bar's width is percent/2 over the counts, a number that exists only at render time. Tailwind generates rules from SOURCE TEXT, so a class assembled around that number gets no rule at all and the bar draws with no width; it carries an inline style attribute instead, which is why the policy in MishkaCmsCore.Runtime.Plugs.SecurityHeaders keeps style-src-attr permitted — see MishkaCmsWeb.InterpolatedClassTest.