Roles and permission presets

Permissions remain the access boundary

Roles are named presets of assignable permissions. Applying one copies the grants onto a user or invitation. Endpoints continue to check individual permissions, and the UI mirrors those checks. See adding a permission.

Admins can create and edit presets in the role editor, then select them in the user permission editor or when inviting users. An actor can save or assign only permissions they hold. Self-service and superadmin capabilities are outside role presets.

Push an edit deliberately

Editing a role does not silently change existing users. Choose the apply option when saving, or use the standalone apply action, to replace assignable grants for users stamped with that preset. The UI shows the affected user count. Applying requires its own permission, skips superadmins and the acting user’s account, audits changes and evicts their authorization caches.

Manually changing a user’s grants away from a preset clears its stamp. Deleting a role clears stamps but preserves the permissions already copied onto users and invitations.

The repository references are docs/api/roles.md and docs/frontend/roles.md.

Verify

• Create a preset, apply it to a user, edit it and confirm the user’s grants remain unchanged until apply.
• Apply the edit and confirm affected users receive the updated assignable grants.
• Delete the preset and confirm copied access remains intact.