--- # Permit.io Roles and Policies Configuration # This file defines the RBAC structure for the Query Orchestration API # Use with Permit.io SDK to programmatically create roles and policies # Resources to be created in Permit.io resources: - name: admin description: Administrative functions (user management) actions: - get - post - patch - delete - head - name: client description: Single client operations actions: - get - post - patch - delete - name: clients description: Clients administration actions: - get - post - patch - delete - name: document description: Document upload and management actions: - get - post - delete - name: export description: Export operations actions: - get - post - name: documents description: Label operations on documents actions: - get - post - name: field-extractions description: Field extraction data for documents actions: - get - post - name: folders description: Folder management for document organization actions: - get - post - patch - delete - name: labels description: Label-based document lookup actions: - get # Roles to be created in Permit.io roles: - name: super_admin description: Full system access for platform administrators permissions: admin: - get - post - patch - delete - head client: - get - post - patch - delete clients: - get - post - patch - delete document: - get - post - delete export: - get - post documents: - get - post field-extractions: - get - post folders: - get - post - patch - delete labels: - get - name: user_admin description: User management - primarily for creating new client users permissions: admin: - get - post - patch - delete - head documents: - get - post field-extractions: - get - post folders: - get - post - name: auditor description: Full read-only access across the entire system for auditing and compliance permissions: admin: - get - head client: - get clients: - get document: - get export: - get documents: - get field-extractions: - get folders: - get labels: - get - name: client_user description: Client-specific access for external users (requires tenant filtering) permissions: client: - get - post - patch clients: - get document: - get export: - get - post documents: - get - post field-extractions: - get - post folders: - get - post - patch labels: - get notes: | This role requires tenant-level filtering by client_id. Currently, client_user will have access to all clients (no tenant isolation). Future implementation will require application-level filtering based on client_id attribute. # Documentation only from here down. # # All of the sections that follow are for documentation only and can be removed. # They are not used by the permit setup tool. # Policy mappings - maps HTTP endpoints to resource:action combinations # This section documents how the dynamic mapping works policy_mappings: admin_endpoints: - path: /admin/users methods: GET: admin:get POST: admin:post - path: /admin/users/{email} methods: GET: admin:get HEAD: admin:head PATCH: admin:patch DELETE: admin:delete - path: /admin/users/{email}/disable methods: POST: admin:post - path: /admin/users/{email}/enable methods: POST: admin:post client_endpoints: - path: /client methods: POST: client:post - path: /client/{id} methods: GET: client:get PATCH: client:patch DELETE: client:delete - path: /client/{id}/status methods: GET: client:get - path: /client/{id}/collector methods: GET: client:get PATCH: client:patch - path: /client/{id}/document methods: GET: client:get POST: client:post - path: /client/{id}/document/batch methods: GET: client:get POST: client:post - path: /client/{id}/document/batch/{batch_id} methods: GET: client:get DELETE: client:delete - path: /client/{id}/export methods: POST: client:post - path: /client/{id}/folders methods: GET: client:get clients_endpoints: - path: /clients methods: GET: clients:get document_endpoints: - path: /document/{id} methods: GET: document:get DELETE: document:delete export_endpoints: - path: /export/{id} methods: GET: export:get field_extraction_endpoints: - path: /field-extractions methods: GET: field-extractions:get POST: field-extractions:post - path: /field-extractions/version methods: GET: field-extractions:get - path: /field-extractions/history methods: GET: field-extractions:get labels_endpoints: - path: /documents/{documentId}/labels methods: POST: documents:post GET: documents:get - path: /labels/{labelName}/documents methods: GET: labels:get folders_endpoints: - path: /folders methods: POST: folders:post - path: /folders/{folderId} methods: PATCH: folders:patch DELETE: folders:delete - path: /folders/{folderId}/documents methods: GET: folders:get - path: /folders/{folderId}/metrics methods: GET: folders:get eula_endpoints: - path: /eula public: true - path: /eula/status authenticated: true no_permission_check: true - path: /eula/agree authenticated: true no_permission_check: true - path: /admin/eula methods: GET: admin:get POST: admin:post - path: /admin/eula/{version_id} methods: GET: admin:get PATCH: admin:patch - path: /admin/eula/{version_id}/activate methods: POST: admin:post - path: /admin/eula/agreements methods: GET: admin:get - path: /admin/eula/compliance methods: GET: admin:get identity_endpoints: - path: /identity authenticated: true no_permission_check: true auth_endpoints: - path: /home public: true - path: /login public: true - path: /login-callback public: true - path: /logout authenticated: true no_permission_check: true - path: /eula public: true - path: /eula/status authenticated: true no_permission_check: true - path: /eula/agree authenticated: true no_permission_check: true - path: /identity authenticated: true no_permission_check: true - path: /swagger/* public: true - path: /metrics public: true - path: /health public: true # Dynamic mapping rules # These define how the middleware extracts resource and action from requests dynamic_mapping: resource_extraction: logic: First path segment after leading slash examples: - url: /client/AAA resource: client - url: /document/019580df-b3f8-7348-9ab1-1e55b3f18ed7 resource: document - url: /admin/users resource: admin - url: /field-extractions resource: field-extractions - url: /labels/contract/documents resource: labels - url: /folders/019580df-1234-5678-abcd-1e55b3f18ed7/documents resource: folders action_extraction: logic: HTTP method converted to lowercase examples: - method: GET action: get - method: POST action: post - method: PATCH action: patch - method: DELETE action: delete - method: HEAD action: head # Implementation notes notes: - Admin endpoints restricted to super_admin and user_admin roles only - Auditor has read-only access across all resources - Client_user currently has access to all clients (no tenant isolation) - Tenant isolation will require application changes (not initial requirement) - /identity, /eula/status, and /eula/agree are auth-only (bypass Permit.io authorization) - /home and /eula are fully public paths (no auth or permit check)