---
id: SCR-PFM-SEC-006
title: New role
route: /console/{tenantId}/security/roles/new
surface: console
product_area: platform
module: security
revision: 1
status: draft
design_intent: proposed
implementation_evidence: observed
inference: []
source_sha:
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
purpose: Create a customer-owned role from permitted policies and inline rules.
supports:
- JNY-PFM-SEC-004
- CAP-PFM-SEC-012
permission: platform.security-roles.manage (page gated on platform.security-roles.read)
entry_from:
- /console/{tenantId}/security/roles
exits_to:
- /console/{tenantId}/security/roles/{roleRef}
displays:
- field: Role name and optional description fields.
  source: RoleEditScreen form
  provenance: observed
- field: Visible active built-in and customer policies available for composition.
  source: listSecurityPolicies
  provenance: observed
- field: Permission choices grouped by application, tier and sensitivity.
  source: getCustomerPermissionCatalog
  provenance: observed
actions:
- label: Validate rules during save
  operation_id: validateSecurityPolicyRules
  permission: platform.security-policies.read
  confirm: false
  provenance: observed
  source: react-console:components/security/roles/role-edit-screen.tsx
- label: Create role
  operation_id: createSecurityRole
  permission: platform.security-roles.manage
  confirm: false
  provenance: observed
  source: react-console:components/security/roles/role-edit-screen.tsx
states:
- loading
- error
- read-only
validation:
- BR-CAP-PFM-SEC-012-03
- BR-CAP-PFM-SEC-012-04
- BR-CAP-PFM-SEC-012-05
- BR-CAP-PFM-SEC-012-06
- BR-CAP-PFM-SEC-012-07
- BR-CAP-PFM-SEC-012-15
patterns:
- SecurityPage guard
- EditorActionBar
- RulesEditor
- BasicInfoFields
component: components/security/roles/role-edit-screen.tsx (RoleEditScreen, create mode)
evidence:
- 'react-console at baf6dae: components/security/roles/role-edit-screen.tsx; the page route file; lib/security/api.ts,
  lib/hq/platform-ops.ts, lib/hq/platform.ts, lib/auth/*'
- react-console:components/security/page-shell.tsx:SecurityPage; lib/authz/backend-aliases.ts (Security aliases)
console_area_permission: security.access
examined_at: '2026-10-23'
examiner: codex
controls: [TC-AVL-005, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-AZ-005, TC-AZ-006, TC-CHG-001, TC-CHG-002, TC-CHG-003, TC-CHG-004, TC-CHG-005, TC-CHG-006, TC-CRY-001, TC-CRY-002, TC-CRY-003, TC-CRY-004, TC-DAT-001, TC-DAT-002, TC-DAT-003, TC-DAT-004, TC-DAT-005, TC-IAM-001, TC-IAM-002, TC-IAM-003, TC-IAM-004, TC-IAM-005, TC-IAM-006, TC-LOG-001, TC-LOG-002, TC-LOG-003, TC-LOG-004, TC-LOG-005, TC-MON-001, TC-MON-003, TC-PI-001, TC-PI-003, TC-PI-005, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-VEN-001, TC-VEN-002, TC-VEN-003]
---

# New role

## What the Screen Is For

Create a customer-owned role from permitted policies and inline rules.

## What It Shows and Lets People Do

The route requires role-reading authority; the editor redirects unless role-management authority is available. Policy reading separately controls the composition/catalog and inline-rule facilities.

## States and Errors

Save applies local field/rule checks and calls server rule validation before role creation where rules need it. This is part of save, rather than a separate validation button. The editor guards unsaved changes and presents indexed server problems without creating a partial role.

The state rows describe observed loading, empty, refusal or inactive handling where present. Linked validation rules belong to the planning layer; client feedback and authoritative service checks have distinct responsibilities.

## Patterns It Must Respect

The pattern list names the built shared components and interaction patterns checked for this screen. This contract describes the existing screen; it supplies no replacement visual design.