Role × Permission Matrix
Authoritative mappings defined in PostgreSQL operational database (ops.role_permissions). Super Admin holds universal rights; Separation of Duties prevents dual assignment of Security Admin and Publisher.
| Permission Identifier | super_admin | security_admin | ops_admin | support_l1 | support_l2 | editor | publisher | translator | analyst | privacy_officer | auditor | readonly |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| authz.matrix_read | ✓ | ✓ | — | — | — | — | — | — | — | — | ✓ | — |
| authz.grant_write | ✓ | ✓ | — | — | — | — | — | — | — | — | — | — |
| content.read | ✓ | — | — | — | — | ✓ | ✓ | ✓ | — | — | — | — |
| content.draft | ✓ | — | — | — | — | ✓ | ✓ | — | — | — | — | — |
| content.publish | ✓ | — | — | — | — | — | ✓ | — | — | — | — | — |
| identity.lookup | ✓ | — | — | ✓ | ✓ | — | — | — | — | ✓ | — | — |
| identity.read_clear | ✓ | — | — | — | ✓ | — | — | — | — | — | — | — |
| security.audit_read | ✓ | ✓ | ✓ | — | — | — | — | — | — | — | ✓ | — |
| security.config_write | ✓ | ✓ | — | — | — | — | — | — | — | — | — | — |
| ops.health_read | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
Assign Role & Scope Constraints
Privileged grant issuance requires Step-Up MFA authentication. All changes immediately record before & after state in the tamper-evident audit ledger.
Live Authorization Policy Evaluator
Test dynamic rule evaluation can(principal, action, resource, ctx) against authoritative database grants and ABAC attribute scopes.