Roles & permissions
Overview
Hierarchical RBAC — roles, permissions, hierarchy levels, and the grant/check operations.
Authorization in Febasi Auth is hierarchical RBAC with permissions in scope:action format. This topic is the operational counterpart to the Authorization concept: how to create roles, assign them, grant individual permissions, and check effective access.
The model in three sentences
- Permissions are
scope:actionstrings (users:create,roles:assign, …) and live in the central catalog. - Roles bundle permissions and carry a hierarchy
level— a higher-level actor can manage lower-level roles, never the inverse. - Users inherit permissions through assigned roles and may also receive individual permissions that override or extend role grants.
Effective permissions are baked into the access token on /login and /refresh, so most authorization checks happen statelessly against the JWT. A live database check is available for the cases where freshness matters.
What's in this topic
RBAC and roles
The full grant lifecycle — create a role, assign it to a user, attach permissions, run a real-time check.
Summary
Cheat sheet: the seven endpoints you'll use most, scopes, and common errors.
Related
- Concepts → Authorization — the model behind hierarchy and effective permissions.
- Registration → Flow — assigning roles right after creating a user.
- Reference → Endpoints — the full roles/permissions endpoint catalog.