diff --git a/lexicons/site/exosphere/spherePermissions.json b/lexicons/site/exosphere/spherePermissions.json
new file mode 100644
index 0000000..4af49b9
--- /dev/null
+++ b/lexicons/site/exosphere/spherePermissions.json
@@ -0,0 +1,51 @@
+{
+  "lexicon": 1,
+  "id": "site.exosphere.spherePermissions",
+  "defs": {
+    "role": {
+      "type": "string",
+      "description": "Minimum role required to perform a core sphere action.",
+      "knownValues": ["owner", "admin"]
+    },
+    "main": {
+      "type": "record",
+      "description": "Permission overrides for core Sphere actions (member management, module management, permission configuration). Published on the Sphere owner's PDS. Only non-default roles need to be specified — absent keys use the built-in defaults.",
+      "key": "literal:self",
+      "record": {
+        "type": "object",
+        "properties": {
+          "invite-member": {
+            "type": "ref",
+            "ref": "#role",
+            "description": "Minimum role to invite members."
+          },
+          "revoke-member": {
+            "type": "ref",
+            "ref": "#role",
+            "description": "Minimum role to revoke members."
+          },
+          "update-member-role": {
+            "type": "ref",
+            "ref": "#role",
+            "description": "Minimum role to change member roles."
+          },
+          "enable-module": {
+            "type": "ref",
+            "ref": "#role",
+            "description": "Minimum role to enable modules."
+          },
+          "disable-module": {
+            "type": "ref",
+            "ref": "#role",
+            "description": "Minimum role to disable modules."
+          },
+          "update-permissions": {
+            "type": "ref",
+            "ref": "#role",
+            "description": "Minimum role to update permissions."
+          }
+        }
+      }
+    }
+  }
+}