Roles and permissions
Roles and permissions
Members keep their built-in role (owner, admin or member) and can hold custom roles on top. A custom role is a named bundle of permissions.
Owners and admins short-circuit the check: they hold everything. Custom roles are how you give a member a specific capability without making them an admin.
The catalogue
People
| Permission | Grants |
|---|---|
member.invite | Invite members |
member.remove | Remove members |
role.manage | Manage custom roles |
| Assign custom roles | Give an existing role to a member |
Content
| Permission | Grants |
|---|---|
blueprint.publish | Publish blueprints |
blueprint.review | Approve drafts |
blueprint.delete | Delete blueprints |
atrium.edit | Edit the Atrium |
folium.edit | Edit foliums |
Structure
| Permission | Grants |
|---|---|
team.create | Create teams |
team.delete | Delete teams |
policy.update | Edit policies |
Governance
| Permission | Grants |
|---|---|
audit.read | Read the audit log |
license.read | View plan and licence |
Integrations and platform
| Permission | Grants |
|---|---|
webhook.manage | Manage outbound webhooks |
integration.manage | Manage Continuum integrations and cloud connections |
sso.manage | Manage SSO |
scim.manage | Manage SCIM provisioning |
network.manage | Manage network access |
Designing roles
Build roles around jobs rather than people. "Docs maintainer"
(folium.edit + blueprint.publish) survives someone changing team;
"Sarah's permissions" does not.
Keep the count small. Every role is something a future admin has to understand before they can safely change anything.