Roles & permissions

A permission is an action on a resource, like order:refund. A role is a named bundle of permissions. Owners build the roles that match their business, and every Webrizen app enforces them.

Built-in roles

Role	Intended for
`owner`	Full control, including billing, deleting the organization and granting ownership
`admin`	Manages people, teams, roles and every product. Can't delete the organization
`member`	Everyday access: request leave, book rooms, view menus, take orders

Built-in roles can't be edited, but you can duplicate one as the starting point for a custom role.

Custom roles

Open Roles & permissions, click New (or pick a template), name the role and tick the actions it should allow. Names are lowercase with dashes, for example shift-supervisor, because apps receive them verbatim.

Changes apply immediately in Webrizen SSO and reach apps on the user's next sign-in or permission refresh.
A role can't be deleted while members still hold it.
No privilege escalation: you can only grant permissions you have yourself. The editor greys out anything else, and the server enforces it too.

Templates

Ready-made starting points for Webrizen products:

hr-managerEmployee Management

employee:read,create,update,deleteattendance:read,manageleave:read,request,approvepayroll:readreport:read,exportmember:createinvitation:create

payroll-officerEmployee Management

employee:readattendance:readpayroll:read,managereport:read,export

restaurant-managerRestaurant Management

menu:read,manageorder:read,create,update,refundtable:read,manageinventory:read,managereport:read,export

cashierRestaurant Management

menu:readorder:read,create,updatetable:read

waiterRestaurant Management

menu:readorder:read,createtable:read

office-adminOffice Management

asset:read,managebooking:read,create,managevisitor:read,managereport:read

receptionistOffice Management

visitor:read,managebooking:read,create

The permission catalog

Every permission a role can include. This table is generated from the code, so it always matches what the role editor offers. The coloured chips show which built-in roles include each resource.

OrganizationWorkspace settings, people, teams and roles.

Organization settings `organization`	updatedelete	owneradminmember
Members `member`	createupdatedelete	owneradminmember
Invitations `invitation`	createcancel	owneradminmember
Teams `team`	createupdatedelete	owneradminmember
Roles & permissions `ac`	createreadupdatedelete	owneradminmember
Billing `billing`	readmanage	owneradminmember
Audit log `audit`	read	owneradminmember

Employee ManagementStaff records, attendance, leave and payroll.

Employees `employee`	readcreateupdatedelete	owneradminmember
Attendance `attendance`	readmanage	owneradminmember
Leave `leave`	readrequestapprove	owneradminmember
Payroll `payroll`	readmanage	owneradminmember

Restaurant ManagementMenus, orders, tables and stock.

Menu `menu`	readmanage	owneradminmember
Orders `order`	readcreateupdaterefund	owneradminmember
Tables `table`	readmanage	owneradminmember
Inventory `inventory`	readmanage	owneradminmember

Office ManagementAssets, room bookings, visitors and reports.

Assets `asset`	readmanage	owneradminmember
Bookings `booking`	readcreatemanage	owneradminmember
Visitors `visitor`	readmanage	owneradminmember
Reports `report`	readexport	owneradminmember

Enforcing permissions in your app

The org.permissions claim contains the resolved permissions: the union of every role the member holds, built-in and custom. Your app never has to know how a role was defined.

import { can } from "@webrizen/sso";
 
if (can(session, "order", "refund")) {
  // show the refund button, allow the API call
}

Without the SDK, it's a one-liner in any language:

allowed = "refund" in claims["org"]["permissions"].get("order", [])

Check on the server

Hiding a button is good UX, but always repeat the permission check in your API handlers. The UI can be bypassed; the server can't.

Adding permissions for a new product

Launching a fourth product, say Inventory Pro? Add its resources in apps/accounts/src/lib/permissions.ts:

apps/accounts/src/lib/permissions.ts

export const statement = {
  ...defaultStatements,
  // …existing resources
  warehouse: ["read", "manage"],
} as const;

Then grant it to the built-in roles as needed and add a group to permissionGroups so it shows in the role editor. No database migration is required: custom roles store their permissions as JSON and are validated against this catalog.