Access Management Overview
Access Management lets you control who can do what in a Plateau Studio application. Instead of hard-coding permissions into each workflow, you define a small set of reusable models and reference them wherever a decision needs to be made — opening a form, picking up a task, or pressing a button.
The Models
| Model | What it is |
|---|---|
| Privilege | The smallest unit of permission — a named label such as approve_record. On its own it does nothing; it is referenced from roles, forms, actions and workflows. |
| Role | A bundle of privileges plus RBAC entries (resource-based CRUD permissions). A user is assigned a role; the role's privileges then apply automatically. |
| Persona | The set of role(s) a user carries at runtime. When a user logs in, every privilege of every role in their persona becomes effective. |
| Swimlane | Decides which role(s) may pick up a workflow User Task from a shared pool. |
| Action | A button on a User Task (e.g. Submit, Approve), bound to a workflow function and, optionally, to button-level privileges. |
Each model has its own editor:
How a User's Permissions Are Resolved
At runtime, permissions flow along a single chain:
User → Persona → Role → Privilege
A user is linked to a persona; the persona carries one or more roles; each role grants a set of privileges (and RBAC permissions). The user effectively holds the union of everything their persona's roles provide.
For how this chain is resolved for a real user at login, see Runtime Persona Resolution.
The Authorization Layers
A single request can be checked at several independent layers. Each layer answers a different question, and all applicable layers must pass.
| Question | Answered by | Semantics |
|---|---|---|
| Which roles does the logged-in user carry? | persona.roles | — |
| Which privileges does a role grant? | role.privileges | — |
| Which resources can a role act on (CRUD)? | role.rbacSet | C/R/U/D |
| Can I start this process? | role.rbacSet[workflow].create | RBAC |
| Can I see this process? | workflow.privileges (root) | AND |
| Can I pick up this task from the pool? | userTask.swimlane → swimlane.roles | role match |
| Can I open this form? | qjson.security.privileges | AND |
| Can I press this button? | action.privileges | AND |
Where a layer lists several privileges (form, action, workflow root), the user must hold all of them. An empty privilege list means the check is skipped — the resource is open to everyone. "Not defined" never blocks.
Where to Go Next
To see these models used together end to end, follow the Access Management tutorial, which builds a complete maker-checker workflow step by step.