ROLE MANAGEMENT
Who may do
what, per tenant.
A role is a named bundle of permissions. Built-in roles are shared by every tenant and cannot be edited; your own tenant can define as many more as it needs.
Roles—
—
CATALOG
Permissions
| Permission | Name | What it allows | Enforced | Roles |
|---|
Every role can grant any name on this list. The nine marked enforced are the ones this application checks before it acts, so granting one changes what the console lets you do. A permission you add here is reported to client applications through /connect/userinfo, which can then enforce it themselves, but no part of this console tests for it.
PERMISSION CATALOG
Roles
| Role | Slug | Permissions | Members | Assignable to you |
|---|
You can only create and assign roles that grant no more than you already hold, so managing members can never be used to gain authority.
HOW THEY ARE USED
Reading a permission
A membership resolves to exactly one role, and that role resolves to a set of permissions. Every tenant-scoped statement asks the database whether the caller holds the permission it needs, so a tenant-defined role is enforced the same way a built-in one is. Assigning a role only succeeds when every permission it grants is one you already hold, which is what stops handing out a role from becoming a way to gain authority.