RBAC roles and permissions
Editions: Free Cloud · Pro · Workers
Roles gate what an app user (or API key bound to a role) may do on secured GraphQL. Platform/Console admins use a separate permission system — do not conflate the two.
Configure roles
- Project → Roles & permissions (wording may vary by Console version).
- Create roles (e.g.
admin,editor,viewer). - Grant model capabilities: read / write / delete (and any engine-specific flags).
- Assign roles to app users.
API keys may inherit a default role — check project auth settings.
Effective permissions
Apps should treat “can this user call mutation X?” as server-enforced. UI soft-gates are optional; never rely on hiding buttons alone.
SaaS
Combine RBAC with tenant isolation: a user may be admin within tenant A and have no access to tenant B. Always pass tenant context on queries.