Reference · Reference

Permissions

Role permissions and API key ceilings generated from the application's runtime access catalog.

This reference is generated from the same access catalog used by the application at runtime.

Ceilings limit grants#

An API key ceiling is the maximum set of actions that type of key may receive. It does not grant those actions by itself, and an empty ceiling means that type of key cannot receive any project action.

Runtime intersection#

A user API key receives only actions present in all three sets: its requested grant, the user API key ceiling, and its owner's active role permissions.

Organization and service API keys receive only actions present in both their requested grant and their corresponding ceiling. Runtime policy checks then evaluate that effective set.

Role access and API key ceilings

Each row comes from the configured action catalog. Checks show actions assigned to a role or allowed by an API key ceiling.

Role grants

Resource	Action	Owner	Admin	Support	Member
Tasks`tasks`	Read`read`	Allowed	Allowed	Allowed	Allowed
Tasks`tasks`	Create`create`	Allowed	Allowed	Not allowed	Allowed
Tasks`tasks`	Update`update`	Allowed	Allowed	Not allowed	Allowed
Tasks`tasks`	Delete`delete`	Allowed	Allowed	Not allowed	Allowed

API-key assignable permissions

Resource	Action	User key	Organization key
Tasks`tasks`	Read`read`	Allowed	Not allowed
Tasks`tasks`	Create`create`	Allowed	Not allowed
Tasks`tasks`	Update`update`	Allowed	Not allowed
Tasks`tasks`	Delete`delete`	Allowed	Not allowed