---
id: SCR-PFM-SEC-007
title: Role view
route: /console/{tenantId}/security/roles/{roleRef}
surface: console
product_area: platform
module: security
revision: 1
status: draft
design_intent: proposed
implementation_evidence: observed
inference: []
source_sha:
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
purpose: Read role composition and manage permitted member grants separately from definition edits.
supports:
- JNY-PFM-SEC-004
- CAP-PFM-SEC-012
- CAP-PFM-SEC-010
- CAP-PFM-SEC-011
permission: platform.security-roles.read
entry_from:
- /console/{tenantId}/security/roles
exits_to:
- /console/{tenantId}/security/roles/{roleRef}/edit
- /console/{tenantId}/security/users/{userId}
displays:
- field: Composed policies, inline rules, record version, kind and copy provenance.
  source: getSecurityRole
  provenance: observed
- field: Reachable role holders and each assignment’s scope.
  source: listSecurityRoleMembers (platform.users.read)
  provenance: observed
- field: Role security events when explanation authority is available.
  source: listSecurityAuditEvents
  provenance: observed
actions:
- label: Edit
  operation_id: (navigates to edit)
  permission: platform.security-roles.manage
  confirm: false
  provenance: observed
  source: react-console:components/security/roles/role-view-screen.tsx
- label: Assign to a member
  operation_id: grantConsoleUserRole
  permission: platform.security-access.manage
  confirm: false
  provenance: observed
  source: react-console:components/security/roles/role-view-screen.tsx
- label: Withdraw from a member
  operation_id: withdrawConsoleUserRole
  permission: platform.security-access.manage
  confirm: true
  provenance: observed
  source: react-console:components/security/roles/role-view-screen.tsx
- label: Duplicate
  operation_id: duplicateSecurityRole
  permission: platform.security-roles.manage
  confirm: false
  provenance: observed
  source: react-console:components/security/roles/role-view-screen.tsx
- label: Archive
  operation_id: archiveSecurityRole
  permission: platform.security-roles.manage
  confirm: true
  provenance: observed
  source: react-console:components/security/roles/role-view-screen.tsx
states:
- loading
- error
- read-only
- inactive
validation:
- BR-CAP-PFM-SEC-012-02
- BR-CAP-PFM-SEC-010-14
- BR-CAP-PFM-SEC-011-10
patterns:
- SecurityPage guard
- DetailHeader
- Tabs
- RoleMembersTab
- RulesReadOnly
- AsyncConfirmDialog
component: components/security/roles/role-view-screen.tsx (RoleViewScreen)
evidence:
- 'react-console at baf6dae: components/security/roles/role-view-screen.tsx; the page route file; lib/security/api.ts,
  lib/hq/platform-ops.ts, lib/hq/platform.ts, lib/auth/*'
- react-console:components/security/page-shell.tsx:SecurityPage; lib/authz/backend-aliases.ts (Security aliases)
console_area_permission: security.access
examined_at: '2026-10-23'
examiner: codex
controls: [TC-AVL-001, TC-AVL-005, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-AZ-005, TC-AZ-006, TC-CHG-001, TC-CHG-002, TC-CHG-003, TC-CHG-004, TC-CHG-005, TC-CHG-006, TC-CRY-001, TC-CRY-002, TC-CRY-003, TC-CRY-004, TC-DAT-001, TC-DAT-002, TC-DAT-003, TC-DAT-004, TC-DAT-005, TC-IAM-001, TC-IAM-002, TC-IAM-003, TC-IAM-004, TC-IAM-005, TC-IAM-006, TC-LOG-001, TC-LOG-002, TC-LOG-003, TC-LOG-004, TC-LOG-005, TC-MON-001, TC-MON-003, TC-PI-001, TC-PI-003, TC-PI-005, TC-SEC-001, TC-SEC-002, TC-SEC-003, TC-SEC-004, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-TEN-004, TC-VEN-001, TC-VEN-002, TC-VEN-003]
---

# Role view

## What the Screen Is For

Read role composition and manage permitted member grants separately from definition edits.

## What It Shows and Lets People Do

The Details tab shows the definition, the Members tab manages holders and History requires explanation authority. Holder reads also require member-reading authority.

## States and Errors

A built-in definition exposes copying, while a custom definition may expose edit and archive under role-management authority. Assignment and withdrawal depend on access-management authority and operate on memberships, not the role’s stored definition. Referenced or assigned definitions remain protected by the API.

The state rows describe observed loading, empty, refusal or inactive handling where present. Linked validation rules belong to the planning layer; client feedback and authoritative service checks have distinct responsibilities.

## Patterns It Must Respect

The pattern list names the built shared components and interaction patterns checked for this screen. This contract describes the existing screen; it supplies no replacement visual design.