Roles & permissions

Axowl uses a snapshot-based RBAC model. Roles are templates; assigning a role to a member resolves its permission templates into a flat, sealed set of effective permissions.

The chain

Permission catalog ("org.setting.update")            what actions exist
   ▲
Role permission template (role ↔ scope expression)   per org
   ▲
Role (ORG_OWNER / ORG_ADMIN / ORG_TEAM_LEAD /
      ORG_MEMBER / ORG_FREELANCER / custom)          per org, has a level
   ▲
Role assignment (member ↔ role)                      per org
   ▼ resolved into a snapshot
Effective permissions (resolved scopes, flattened)   ← what a permission check reads

Key ideas

• The permission catalog lists what actions exist. It carries the base scope only.
• A role permission template binds a permission to a role with an expression that may contain variables, e.g. org.project.read:project={project}.
• Assigning a role fills in the variables and writes the member’s flat set of resolved scopes. Permission checks read only that set.
• A template may be a deny (deny view.billing). A deny overrides a matching allow, which is how ORG_ADMIN holds everything except billing.
• Roles are the single source of truth. The membership type (Owner/Admin/Member) is derived from the member’s highest role level — never set independently. See Connected ID.

Preset roles

Every org is created with these preset roles:

Role	Level	Scopes
ORG_OWNER	Owner	org.*, view.*
ORG_ADMIN	Admin	org.*, view.*, with denies on the Owner-only scopes view.billing, org.org.billing_manage and view.roost
ORG_TEAM_LEAD	Write	Everything ORG_MEMBER has, plus managing members and reporting lines, reporting documents, end users, devices, data source connections, and read access to settings
ORG_MEMBER	Read	Organization overview, applications and reporting screens; app groups (deleting only ones they created); reading reporting documents and creating approval forms; their own files and their own audit records; reading devices and data sources
ORG_FREELANCER	Read	Same as ORG_MEMBER, but app-group access is limited to the app group assigned at invite; joins with a personal email
ORG_GUEST	Read	view.organization, org.org.read — the overview only
PROJECT_GUEST	Read	One project only — org.project.read and org.project.list bound to the project named at assignment
MEETING_GUEST	Read	One meeting only — org.meeting.read and org.meeting.list bound to the meeting named at assignment
ROOST_ADMIN	Write	view.roost plus Roost read and operating scopes — fixed: cannot be edited or deleted; only the Owner assigns or revokes it
ROOST_AUDITOR	Read	view.roost plus Roost read scopes and audit log read — fixed

ORG_TEAM_LEAD also differs from ORG_MEMBER by its level, which approval routing uses. ORG_FREELANCER is for external contractors and is selected via the invite’s Is Freelancer option. Legal entities (Corporation / SPC) also get a locked REPRESENTATIVE_DIRECTOR role at Owner level (org.*, view.*) and an ORG_DIRECTOR role (Read level; ORG_MEMBER scopes plus board-meeting scopes).

ROOST_ADMIN (Roost Admin) and ROOST_AUDITOR (Roost Auditor) are the only ways besides the Owner into the Roost section. view.roost is an Owner-only scope, so an Admin needs one of these roles to open Roost. See Roost → Who can open Roost.

Roost hardware adds a second axis of roles that live on the device ledger, not in RBAC: SecurityOfficer, Operator, User and Auditor. The Auditor is the only one that changes what the organization can do with its audit log — once appointed (Owner quorum seal), the log is Auditor-only. See the role table in Roost → Roles.

Custom roles are created in the dashboard and carry any subset of the catalog. See the full scope list in Permission scopes.

Variables & immutability

A snapshot is a point-in-time grant: the scopes a member holds are the ones resolved when the snapshot was written, with the variables filled in at that moment. When a role is changed — renamed, or a permission added to it or removed from it — every member who holds that role is re-snapshotted automatically, like a card being re-issued, so holders gain and lose the permission without being reassigned.