---
id: SCR-PFM-SEC-008
title: Edit role
route: /console/{tenantId}/security/roles/{roleRef}/edit
surface: console
product_area: platform
module: security
revision: 1
status: draft
design_intent: proposed
implementation_evidence: observed
inference: []
source_sha:
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
purpose: Change a custom role’s policies and inline rules with version-aware save.
supports:
- JNY-PFM-SEC-004
- CAP-PFM-SEC-012
- CAP-PFM-SEC-014
permission: platform.security-roles.read (SecurityPage view guard; editor additionally requires management
  authority and redirects when absent)
entry_from:
- /console/{tenantId}/security/roles/{roleRef}
exits_to:
- /console/{tenantId}/security/roles/{roleRef}
displays:
- field: Loaded role composition and its record version.
  source: getSecurityRole
  provenance: observed
- field: Visible editor permission catalog.
  source: getCustomerPermissionCatalog
  provenance: observed
- field: Save-result notices summarize affected people and assignments.
  source: patchSecurityRole response
  provenance: observed
actions:
- label: Validate rules during save
  operation_id: validateSecurityPolicyRules
  permission: platform.security-policies.read
  confirm: false
  provenance: observed
  source: react-console:components/security/roles/role-edit-screen.tsx
- label: Save
  operation_id: patchSecurityRole
  permission: platform.security-roles.manage
  confirm: false
  provenance: observed
  source: react-console:components/security/roles/role-edit-screen.tsx
states:
- loading
- error
validation:
- BR-CAP-PFM-SEC-012-10
- BR-CAP-PFM-SEC-012-11
- BR-CAP-PFM-SEC-012-12
- BR-CAP-PFM-SEC-012-13
- BR-CAP-PFM-SEC-014-07
- BR-CAP-PFM-SEC-014-13
patterns:
- SecurityPage guard
- EditorActionBar
- RulesEditor
- BasicInfoFields
component: components/security/roles/role-edit-screen.tsx (RoleEditScreen, edit mode)
evidence:
- 'react-console at baf6dae: components/security/roles/role-edit-screen.tsx; the page route file; lib/security/api.ts,
  lib/hq/platform-ops.ts, lib/hq/platform.ts, lib/auth/*'
- react-console:components/security/page-shell.tsx:SecurityPage; lib/authz/backend-aliases.ts (Security aliases)
console_area_permission: security.access
examined_at: '2026-10-23'
examiner: codex
controls: [TC-AVL-004, TC-AVL-005, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-AZ-005, TC-AZ-006, TC-CHG-001, TC-CHG-002, TC-CHG-003, TC-CHG-004, TC-CHG-005, TC-CHG-006, TC-CRY-001, TC-CRY-002, TC-CRY-003, TC-CRY-004, TC-DAT-001, TC-DAT-002, TC-DAT-003, TC-DAT-004, TC-DAT-005, TC-IAM-001, TC-IAM-002, TC-IAM-003, TC-IAM-004, TC-IAM-005, TC-IAM-006, TC-LOG-001, TC-LOG-002, TC-LOG-003, TC-LOG-004, TC-LOG-005, TC-MON-001, TC-MON-003, TC-PI-001, TC-PI-002, TC-PI-003, TC-PI-004, TC-PI-005, TC-PRV-001, TC-PRV-002, TC-SEC-001, TC-SEC-002, TC-SEC-003, TC-SEC-004, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-TEN-004, TC-VEN-001, TC-VEN-002, TC-VEN-003]
---

# Edit role

## What the Screen Is For

Change a custom role’s policies and inline rules with version-aware save.

## What It Shows and Lets People Do

The route applies role-reading authority, then the editor redirects built-ins and callers without role-management authority to view. Policy-reading authority separately controls the rule/composition facilities.

## States and Errors

Save validates rules, submits the loaded version and reports delegation, lockout or stale-record refusals. Returned impact is feedback from the save result. The eligibility-binding operation exists in the service but no binding action is offered by this editor.

The state rows describe observed loading, empty, refusal or inactive handling where present. Linked validation rules belong to the planning layer; client feedback and authoritative service checks have distinct responsibilities.

## Patterns It Must Respect

The pattern list names the built shared components and interaction patterns checked for this screen. This contract describes the existing screen; it supplies no replacement visual design.