RBAC roles and permissions
Editions: Free Cloud · Pro · Workers
Roles gate what an app user (or API key bound to a role) may do on secured GraphQL. Platform/Console admins use a separate permission system — do not conflate the two.
Configure roles
- Project → Roles & permissions (wording may vary by Console version).
- Create roles (e.g.
admin,editor,viewer). - Grant model capabilities: read / write / delete (and any engine-specific flags).
- Assign roles to app users.
API keys may inherit a default role — check project auth settings.
Effective permissions
Apps should treat “can this user call mutation X?” as server-enforced. UI soft-gates are optional; never rely on hiding buttons alone.
Per-project roles
Each project has its own roles. A role in one project does not grant access in another.