Roles and permissions

Roles and permissions An architecture diagram generated by Archify. OWNER · Full authority · Architecture component OWNER Full authority Delete workspace · workspace:delete · OWNER adds these, and keeps everything below Delete workspace workspace:delete Transfer ownership · workspace:transfer_ownership · OWNER adds these, and keeps everything below Transfer ownership workspace:transfer_ownership ADMIN · Runs the fleet · Architecture component ADMIN Runs the fleet Manage agents · agent:manage · ADMIN adds these, and keeps everything below Manage agents agent:manage Manage devices · device:manage · ADMIN adds these, and keeps everything below Manage devices device:manage Manage accounts · account:manage · ADMIN adds these, and keeps everything below Manage accounts account:manage Credentials · account:write_credentials · ADMIN adds these, and keeps everything below Credentials account:write_credentials Invite and set roles · member:invite · ADMIN adds these, and keeps everything below Invite and set roles member:invite Retry and cancel jobs · job:retry · job:cancel · ADMIN adds these, and keeps everything below Retry and cancel jobs job:retry · job:cancel Workspace settings · workspace:update · ADMIN adds these, and keeps everything below Workspace settings workspace:update CREATOR · Content only · Architecture component CREATOR Content only Upload media · media:write · CREATOR can do these Upload media media:write Compose posts · post:write · CREATOR can do these Compose posts post:write Schedule and cancel · post:schedule · post:cancel · CREATOR can do these Schedule and cancel post:schedule · post:cancel View fleet and history · device:read · job:read · CREATOR can do these View fleet and history device:read · job:read CREATOR can do these ADMIN adds these, and keeps everything below OWNER adds these, and keeps everything below

Enforced on the server

  • • withWorkspace() proves session, membership and permission
  • • A non-member gets 404, not 403 — membership is not an oracle
  • • Hiding a button is a courtesy; the server check is the control

The creator decision

  • • Creators own the calendar: they schedule and cancel their posts
  • • They cannot retry a device job — that is operational recovery
  • • They can read devices and accounts, to choose where to post

Structural invariants

  • • Owner ⊃ Admin ⊃ Creator, asserted by unit tests
  • • Only an owner can assign the owner role
  • • A workspace always keeps at least one owner