Roles & capabilities.
Six organisation roles mapped onto a 16-entry capability catalogue, checked server-side at the point of use.
How authorisation resolves
A member's effective capabilities are their role's base grants unioned with any per-user grants:
| Input | Effect |
|---|---|
is_platform_admin | Everything, everywhere. Short-circuits to a wildcard. |
role org_admin | Everything within its own tenant. Also a wildcard. |
| Any other role | The role's base set from the capability matrix |
tenant_admin_capabilities | Per-user grants, unioned on top |
A per-user grant never removes a capability the role already gives. That is why the access-control editor renders role-derived capabilities as checked and disabled — un-ticking one would be a no-op that looked like a revoke. To reduce someone's access you change their role.
The roles
| Role | Intended for |
|---|---|
org_admin | Full control of its own tenant |
org_developer | Operational plus own keys and credentials; no user or billing admin |
org_responder | Analyst work plus source management and report scheduling |
org_analyst | Investigate — KB, Co-Analyst, private intel; read audit |
org_auditor | Compliance read-only: audit, billing, reports. No operations |
org_viewer | Dashboards and reports, read-only |
The capability catalogue
16 capabilities across seven groups. Each is checked server-side by requireCapability() at the point of use — not once at login, and not in the UI layer.
- Knowledge base — view, queue ingestion, manage sources.
- Investigations — use the Co-Analyst, submit private intel.
- Users — manage users, manage admins, view audit.
- Keys — manage API keys, manage vault credentials.
- Billing — view billing and usage.
- Branding — manage theme, manage settings.
- MSSP · Reports — manage sub-tenants; view and schedule reports.
Adding a capability is a one-line addition to the catalogue — the column is free text, so no migration is needed.
Templates
Four curated sets exist so an admin does not tick 16 boxes: full tenant admin, read-only analyst, ops/SOC operator, and billing manager. They are a starting point, not a role — the underlying grant is still per-capability.
Seeing effective access
The platform access-control surface renders the role → capability matrix from the same source the enforcement uses, so it cannot drift, and shows each membership's effective count split into “from role” versus “granted”. It also flags redundant grants — per-user rows the role already covers.
See multi-tenancy for how a role interacts with tenant scope.