Model customer responsibilities with roles and policies

Purpose

Customers need access definitions that reflect how their staff work. Roles and policies provide the reusable building blocks administrators assemble before assigning authority to colleagues.

How It Works

The administrator starts with available policies or creates a customer policy. The rule editor supplies catalog choices and validation feedback. Conditions can express supported restrictions, while eligibility references depend on the separate binding owner and deployed switch. The administrator assembles a role from policies and inline rules. A placeholder role can be saved without implying it already grants access. Copying a built-in provides a starting point for customer changes while preserving a reference to its source. Before changing a definition in use, staff inspect affected assignments and any delegation refusal. A stale save asks the editor to reconcile newer work instead of overwrite it. Archive gives an unused definition a retained history; in-use refusal identifies what staff must address first. Permission changes request cache propagation but do not promise that every previously cached request immediately sees the edit.

Relationships

• The release catalog supplies built-in definitions and permission names.
• Scoped role assignment applies the composed role to people.
• Security history explains definition edits and their impact.
• Eligibility owns the bindings used by supported eligibility conditions.