Roles (rbac.yaml)

File: config/agents/rbac.yaml · Schema: schemas/rbac.schema.json

Roles, what each can do, and what it inherits.

Fields

Field	Type	Description
roles	map of name → RoleDef	Required. Roles by name. A user's roles are stored on the user (users.roles).

Unknown fields are refused at boot.

Types

Types referred to by the fields above, from the same schema.

RoleDef

Field	Type	Description
can	list of string	Permissions, e.g. runs.start, approvals.resolve. Default: [].
inherits	list of string	Roles whose permissions this role also holds. Each must be declared. Default: [].

Unknown fields are refused at boot.

In this repository

config/agents/rbac.yaml

roles:
  viewer: { can: [runs.read, documents.read] }
  clerk: { can: [runs.read, runs.start, documents.read, documents.upload] }
  approver: { inherits: [clerk], can: [approvals.resolve] }
  admin: { inherits: [approver], can: [config.read, tenants.manage] }

Editor support

The schemas are generated from the Rust definition structs (task schema_export), and a test fails when they drift. Point a YAML language server at the schema to get completion and validation while editing:

# yaml-language-server: $schema=../../schemas/rbac.schema.json