Role-Based Access Control (RBAC) Setup
Default Roles
The platform includes four built-in roles that cannot be deleted: Owner (full access including billing and organization deletion), Admin (full access except billing and ownership transfer), Member (read/write access to projects and resources), and Viewer (read-only access). Each role inherits all permissions from the roles below it in the hierarchy.
Assign roles at the organization or project level. Organization-level roles apply to all projects within the organization. Project-level roles override organization-level roles for that specific project, allowing you to grant broader access to one team while restricting others. View current role assignments via GET /org/members or GET /projects/:id/members.
Custom Roles
Create custom roles with fine-grained permissions: POST /org/roles with {"name": "Security Auditor", "permissions": ["audit-log:read", "alerts:read", "policies:read", "reports:export"]}. Permissions follow a resource:action format. Available actions are read, write, delete, and admin. Use resource:* to grant all actions on a resource.
Separation of duties constraints prevent conflicting permissions from being assigned to the same role or user. For example, the policies:write and policies:approve permissions cannot be combined in a single role, ensuring that policy changes require approval from a different user. Configure custom separation constraints via POST /org/roles/constraints with the conflicting permission pairs.
Policy-as-Code with OPA
For complex authorization requirements, integrate with Open Policy Agent (OPA) to define access policies in Rego. Push policies via PUT /org/policies/opa with your Rego policy bundle. Policies are evaluated on every API request, with the request context (user identity, resource, action, time, IP address) passed as input to the policy engine.
Example Rego policy that restricts production environment access to senior engineers during business hours: default allow = false / allow { input.user.role == "senior-engineer"; input.resource.environment == "production"; time.clock(input.timestamp)[0] >= 9; time.clock(input.timestamp)[0] < 17 }. Test policies locally using the OPA CLI before deploying to production.
Peer-reviewed and accepted for publication. Supplementary data available via linked endpoints.