​

RBAC Permissions Matrix

​

Roles

​

Permission Categories

​

Requirements

​

Relationships

​

Jobs (Ingestion)

​

Audit Logs

​

Workspace Management

​

User Management

​

Integrations

​

Permission Inheritance

Owner (Level 3)
  └── Admin (Level 2)
        └── Editor (Level 1)
              └── Viewer (Level 0)

1. Check if user’s role level >= minimum required role level
2. If using granular permissions, check if permission is in role’s permission set

​

Implementation

​

Python Decorator

from traceo_mcp_server.auth.rbac import require_permission

@require_permission("requirements:delete")
async def delete_requirement(requirement_id: str) -> str:
    # Only admins and owners can execute this
    ...

​

FastAPI Dependency

from traceo_mcp_server.auth.rbac import Permission

@router.delete("/requirements/{id}")
async def delete_requirement(
    id: str,
    _: None = Depends(Permission("requirements:delete"))
):
    ...

​

Audit Events

• User ID
• Permission checked
• Resource type and ID
• Result (allowed/denied)
• Timestamp

​

Role Assignment

• New users are assigned Viewer role by default
• Workspace creators are automatically assigned Owner role
• Only Owners can promote users to Admin
• Admins can promote Viewers to Editors

​

Security Considerations

1. Principle of Least Privilege: Start with Viewer role, grant higher permissions as needed
2. Permission Caching: Permissions are cached per request, not globally
3. Audit Trail: All role changes are logged in audit log
4. No Horizontal Privilege Escalation: Users cannot access other workspaces’ resources
5. Token Validation: Role is validated from JWT on every request