Permissions matrix¶
This page is a snapshot of the role × permission matrix as
defined in
fedms_federation/config/roles_permissions.yml.
For the live truth, always check that file.
Living document
The matrix evolves as the framework matures. Open issues
affecting the permission model are tracked at
fedms/components/profile#10.
The tables on this page summarize the current state.
Site-wide permissions¶
| Permission | manager | host | devops |
|---|---|---|---|
| access group overview | ✓ | ✓ | |
| create org group | ✓ | ✓ | |
| create event group | ✓ | ✓ | |
| create session group | ✓ | ✓ |
Org-level permissions¶
Roles: Manager, Host/Sponsor, Service Provider, Speaker/Tutor, Moderator, Attendee/Delegate, Observer.
The Manager role has the broadest org-level permissions. Other
individual roles inherit the member permissions (view group, view
group media of various types) and add little on top.
| Permission | manager | host |
|---|---|---|
| administer members | ✓ | |
| edit group | ✓ | |
| create subgroup:event entity | ✓ | |
| view any unpublished group | ✓ | |
| view group_membership relationship | ✓ | |
| view own unpublished group | ✓ | |
| view own unpublished group_media (all types) | ✓ | ✓ |
| view unpublished group_media (all types) | ✓ | ✓ |
| view own unpublished group_node (book, page) | ✓ | ✓ |
| view unpublished group_node (book, page) | ✓ | ✓ |
| create group_media (all types) entity & relationship | ✓ | |
| update any group_media (all types) entity & relationship | ✓ | |
| update own group_media (all types) entity & relationship | ✓ | |
| view group_media (all types) relationship | ✓ | |
| create group_node (book, page) entity & relationship | ✓ | |
| update any group_node (book, page) entity & relationship | ✓ | |
| update own group_node (book, page) entity & relationship | ✓ |
The member insider role gets:
- view group
- view group_media (all types) entity
- view group_node:book relationship
- view group_node:page relationship
Event-level permissions¶
Roles: Manager, Host/Sponsor, Service Provider, Speaker/Tutor, Moderator, Attendee/Delegate, Observer.
The same pattern as Org, with these event-specific additions for Manager:
| Permission | manager | host |
|---|---|---|
| create fedms_event:in entity & relationship | ✓ | |
| update any fedms_event:in entity & relationship | ✓ | |
| update own fedms_event:in entity & relationship | ✓ | |
| view fedms_event:in relationship | ✓ | |
| create subgroup:session entity | ✓ | |
| update any subgroup:session relationship | ✓ | |
| update own subgroup:session relationship | ✓ |
And member adds:
- view fedms_event:in entity
Session-level permissions¶
Same pattern as Event, with session-specific additions for Manager:
| Permission | manager | host |
|---|---|---|
| create fedms_session:in entity & relationship | ✓ | |
| update any fedms_session:in entity & relationship | ✓ | |
| update own fedms_session:in entity & relationship | ✓ | |
| view fedms_session:in relationship | ✓ |
member adds:
- view fedms_session:in entity
Roles that are placeholders today¶
Several individual roles are defined but carry no extra permissions yet:
attendee(event, session)moderator(event, session)observer(event, session)service(event, session)speaker(event, session)
They inherit the member permissions and, for now, behave like a
generic Member. As the role-specific UX matures, role-specific
permissions will be added. The tracking issue is
fedms/components/profile#10.
How to read the YAML¶
Each role block in roles_permissions.yml has up to four keys:
| Key | Meaning |
|---|---|
label |
Display name. |
weight |
Display ordering and "seniority". |
admin |
(Optional) true if this role bypasses access checks. |
scope |
insider or outsider for sync-driven roles; absent for individual roles. |
global_role |
Site role that drives this group role (for sync-driven roles). |
permissions |
List of permission strings granted to this role. |
Future work¶
- Per-role permission tables in this page should be generated from the YAML at build time — currently they are hand-maintained. This is on the to-do list for the documentation tooling.
- Adding new permissions (e.g. for the upcoming Notification feature,
see
fedms/components/federation#23) means extending both the YAML and this page.