Permissions

Where roles live#

Matruno stores workspace membership roles on workspace_users.roles. The authenticated AuthContext loads roles for the active workspace and checks permissions against a role registry for known roles.

The user record can also carry platform-level roles such as platform_admin or system, which are treated differently from ordinary workspace roles.

Implemented role checks#

The central permission registry defines admin, workspace_admin, process_manager, and operator. Workspace member APIs expose member, workspace_admin, and auditor for member management. Other workflow/task surfaces also check process and matter participation roles such as case_manager and case_assistant.

Those case_* keys are current implementation identifiers used for matter/task filtering. They are not a separate Cases product surface.

Document these as current implementation details, not as a polished final RBAC taxonomy.

Field-level masking#

Blueprint-backed payloads can define field_permissions. The auth permissions helper masks restricted JSON fields unless the caller has one of the allowed roles. This supports field-level visibility for structured matter payloads where the blueprint is configured, including confidential or privileged fields.