Configure your first RBAC Policy

Role-Based Access Control (RBAC) grants access to resources through roles: you give permissions to a role, and assign roles to users. Each user gets only the access their role needs. For more on RBAC, read the blog post or the Permit RBAC page.

For example, in a web application, an "Admin" role might have full access to manage resources, while a "Viewer" role can only view them.

In this guide, you configure your first RBAC policy step by step: create a role, define a resource and its actions, grant permissions, and assign the role to a user.

1

Creating your first role

Start by defining roles. A role is a set of permissions to perform actions on resources, and it determines what a user can or cannot do in your system.

In this example, you create a role called Admin, which usually represents the highest level of access.

Make sure the name is clear and meaningful, reflecting the purpose of the role. You can also pass a key to uniquely identify a role and a description to offer a more meaningful explanation of the role.

To create the Admin role:

1. Navigate to the Policy Screen
2. Click Create a Role
3. Enter "Admin" as the name of the role.

2

Creating a resource and its actions

1. Navigate to the Policy Screen.
2. Click Create a Resource.
3. Enter Document as the name of the resource. Use a name that clearly represents the object in your system that needs controlled access, such as a file, database entry, or, in this case, a document.
4. Add the actions associated with this resource. Start with Permit's predefined actions: create, read, update, and delete (CRUD). They cover the basic operations most systems need.
5. Optionally, add custom actions to reflect specific operations relevant to your use case. For example, add a custom action called publish, representing an operation specific to document management.

note

Combine predefined and custom actions to model the operations your application actually has.

3

Configuring RBAC permissions in the Policy editor

With the role and resource in place, define the permissions for the Admin role. In the Policy Editor, you choose which actions each role can perform on each resource.

1. Navigate to the Policy Editor Screen.
2. Find the Admin role, and the Document resource underneath the role.
3. Tick the actions the Admin role can perform on the Document resource:
   • create
   • read
   • publish (the custom action defined earlier).

Each ticked box maps an action on a resource to a role. Change the boxes and the policy changes, without touching your code.

4

Add a user and assign a role

Finally, add a user and grant them access through the role.

tip

Users represent the people or services that interact with your application, and roles determine what they can do.

1. Navigate to the Directory page.
2. Click Add User.
3. Enter sam@permit.io as the user's email address. Use the email of the person who should receive access.
4. Assign the Admin role to this user by selecting it from the list of available roles. The user can now perform every action you granted to that role.

Your RBAC setup is ready: the Admin role has the permissions you granted on the Document resource, and sam@permit.io has the Admin role.

What did you learn?

You configured your first RBAC policy: you created a role, defined a resource with actions, set permissions, and assigned the role to a user. Every other policy model in Permit builds on these same pieces.

What's next? 🎉

• Fetching your API key
• Initializing the Permit Instance
• Performing your first API call

Congratulations! A great start!