Roles, permission keys and why an action was refused
Every permission is a key of the form <resource>.<verb>; roles are bundles of these keys. A refusal tells you that you do not hold that key in that scope.
For: Platform administrator, Builder, Account administrator, Tenant administrator, Operator, Auditor, Member
Permission key
In inlorus every permission is a key of the form resource.verb: membership.write, capability.publish, audit.read and so on. There are four verbs, kept apart on purpose:
| Verb | Meaning | Risk |
|---|---|---|
read | See. | low |
write | Create and change. | medium |
publish | Open for others to use. | high |
purge | Delete irreversibly. Granted only in the scope that owns the data. | critical |
There is no verb meaning “manage everything”. Such a verb could not express least privilege: to give a builder the right to build, you would also have to make them an administrator.
Five role archetypes
| Archetype | What for |
|---|---|
| Administrator | Every key in the scope it is assigned in. Deletion applies only to that scope's own data. |
| Builder | The bundle needed to build and stay there: capability, solution, app, metadata and workspace. |
| Operator | Running what others have built: operations and integrations. |
| Member | Using the product: reading and writing records. Can be held only in a tenant. |
| Auditor | Every read key and nothing else. |
Platform, account and tenant admins are not separate roles: the same Administrator role is assigned in three different scopes.
Why an action is refused
When you open a screen or press a button, inlorus evaluates that job's key by checking whether you hold it in the scope you are in. If you do not, the action is refused, and inlorus does not hide it:
- If the screen itself is locked, it says “You don't have access to this surface:
key(scope)” and, below that, who can grant the permission. - If a button was refused, the refusal is shown with the
NOT_PERMITTEDcode, together with the missing key and the scope. - No explicit “deny” rule has been written to date; a refusal comes from no rule matching that grants that key in that scope (
default_deny_no_matching_rule).
Tip You can see where your permission comes from, or why it doesn't, for the selected scope on the My Access screen.