Loading…
The role-based access control catalog this tenant’s agent ships today. Roles are hierarchical by permission-set superset, aligned to the shared permission vocabulary used by the server guard, the GET /api/session/permissions flags, and audit records.
Not yet available — backend pending. Enforcement is currently off (graphvm.agent.iam.enforce=false grants every permission) and there is no API to assign or edit roles. The grants below are read off iam/Role.java, so they are what would apply the moment enforcement is switched on — not a proposal; assignment controls will activate once the RBAC PermissionService and membership-admin endpoints land.
| Role | Intent | Permissions |
|---|---|---|
| Viewer | Read-only: graphs and runs (ungated surfaces) | 0 |
| Editor | Build and run graphs | 3 |
| Operator | Build, publish to the catalog, read the audit log | 5 |
| Admin | Everything, including the audit log | 9 |
| Permission | Viewer | Editor | Operator | Admin |
|---|---|---|---|---|
| Edit graphscanEditGraphs | — | ✓ | ✓ | ✓ |
| Run graphscanRunGraphs | — | ✓ | ✓ | ✓ |
| Import / exportcanImportExport | — | ✓ | ✓ | ✓ |
| Publish nodescanPublishNodes | — | — | ✓ | ✓ |
| View audit logcanViewAudit | — | — | ✓ | ✓ |
| Manage userscanManageUsers | — | — | — | ✓ |
| Manage teamscanManageTeams | — | — | — | ✓ |
| Manage organizationcanManageOrganization | — | — | — | ✓ |
| Manage webhookscanManageWebhooks | — | — | — | ✓ |
Custom / tenant-defined roles are out of scope for v1; the enum above is the fixed catalog. See doc/RBAC_DESIGN_PLAN.md §4 for the full model and §7 for the rollout phases.