Resolve the requested resource
Load the project, workspace, or other resource through the consumer app's own data layer.
Developer guide / Permissions
Grant access in context
Perminister grants are scoped to a consumer application and, where needed, to a resource owned by that application. The consumer app still enforces each decision on its server.
Generic scope shapes
Administrators create grants in the dashboard. IDs and actions are supplied by each consumer application; Perminister has no fixed catalog.
| Scope kind | Identifier | Use |
|---|---|---|
| Product | productId | Grant actions across one consumer application's boundary. |
| Project | projectId | Limit actions to a project that the consumer app owns. |
| Workspace | workspaceId | Limit actions to a workspace that the consumer app owns. |
Enforcement stays with the consumer
POST /api/authorize checks the bearer key's scope and actions against the account's current grants. The consumer application still loads and enforces access against its own resource.
Compare scope and actions
Check that the identity or API key has a grant for the correct consumer and resource, with the action required by the request.
Apply the decision server-side
Do not rely on hidden UI controls as authorization. The consumer app enforces every protected operation against its own resource.