Appearance

Roles & Permissions ​

MapexOS uses Role-Based Access Control (RBAC) to enforce least-privilege access across a multi-tenant organization hierarchy.

Permissions are assigned through Roles, and Roles are applied to Users or Groups via Memberships scoped to an organization node.

Applies to v1.0.0 — Permission strings below reflect the current implementation.

Core model ​

Permission ​

A permission is a string identifier used by services to authorize an operation.

Examples:

  • assets.read
  • rules.create
  • events.processed.list

Role ​

A role is a named collection of permissions, designed to be reusable across teams.

Membership ​

A membership binds:

  • WHO: user or group
  • WHERE: organization (scope)
  • WHAT: roles/permissions
  • HOW FAR: local or recursive

Permission naming conventions ​

MapexOS permissions follow a simple pattern:

  • Standard resources: <resource>.<action>
    • Example: assets.update
  • Wildcards: <resource>.*
    • Example: routegroups.*
  • Event streams: events.<stream>.<action>
    • Example: events.raw.read

Actions (typical) ​

Most resources expose standard CRUD actions:

list, create, read, update, delete

Wildcards ​

MapexOS supports hierarchical wildcards:

WildcardMeaning
mapex.*Full platform access (all services/modules)
<resource>.*Full access to a single resource

Example:

  • datasources.* allows all datasource operations, but does not grant access to assets or rules.

Scope and inheritance ​

Roles and permissions are scoped by organizations through memberships.

  • local applies only to the specified organization
  • recursive applies to the organization and all descendants (unless blocked by RolePolicy = strict)

For details on organization inheritance policies, see:

Examples ​

Read-only operator (events + assets) ​

A common operational profile can be modeled with:

txt
assets.list
assets.read
events.processed.list
events.processed.read

Automation engineer (rules + triggers) ​

A profile focused on automation:

txt
rules.*
businessrules.*
triggers.*
routegroups.read
routegroups.list

Platform admin (full access) ​

txt
mapex.*

Permission reference (v1.0.0) ​

This section lists the permissions available in the current release.

Note: Events expose stream-level permissions for fine-grained access.

Platform ​

PermissionDescription
mapex.*Wildcard access for all mapex operations

Core platform ​

These permissions control governance objects in the MapexOS Core service.

auth ​

PermissionDescription
auth.*Wildcard access for all auth operations
auth.changepasswordCHANGEPASSWORD auth
auth.loginLOGIN auth
auth.logoutLOGOUT auth
auth.refreshREFRESH auth
auth.resetpasswordRESETPASSWORD auth

organizations ​

PermissionDescription
organizations.*Wildcard access for all organizations operations
organizations.createCREATE organizations
organizations.deleteDELETE organizations
organizations.listLIST organizations
organizations.readREAD organizations
organizations.updateUPDATE organizations

users ​

PermissionDescription
users.*Wildcard access for all users operations
users.createCREATE users
users.deleteDELETE users
users.listLIST users
users.readREAD users
users.updateUPDATE users

groups ​

PermissionDescription
groups.*Wildcard access for all groups operations
groups.createCREATE groups
groups.deleteDELETE groups
groups.listLIST groups
groups.readREAD groups
groups.updateUPDATE groups

roles ​

PermissionDescription
roles.*Wildcard access for all roles operations
roles.createCREATE roles
roles.deleteDELETE roles
roles.listLIST roles
roles.readREAD roles
roles.updateUPDATE roles

memberships ​

PermissionDescription
memberships.*Wildcard access for all memberships operations
memberships.createCREATE memberships
memberships.deleteDELETE memberships
memberships.listLIST memberships
memberships.readREAD memberships
memberships.updateUPDATE memberships

lists ​

PermissionDescription
lists.*Wildcard access for all lists operations
lists.createCREATE lists
lists.deleteDELETE lists
lists.listsLISTS lists
lists.readREAD lists
lists.updateUPDATE lists

Ingestion & asset management ​

datasources ​

PermissionDescription
datasources.*Wildcard access for all datasources operations
datasources.createCREATE datasources
datasources.deleteDELETE datasources
datasources.listLIST datasources
datasources.readREAD datasources
datasources.updateUPDATE datasources

assets ​

PermissionDescription
assets.*Wildcard access for all assets operations
assets.createCREATE assets
assets.deleteDELETE assets
assets.listLIST assets
assets.readREAD assets
assets.updateUPDATE assets

assettemplates ​

PermissionDescription
assettemplates.*Wildcard access for all assettemplates operations
assettemplates.createCREATE assettemplates
assettemplates.deleteDELETE assettemplates
assettemplates.listLIST assettemplates
assettemplates.readREAD assettemplates
assettemplates.updateUPDATE assettemplates

Routing ​

routegroups ​

PermissionDescription
routegroups.*Wildcard access for all routegroups operations
routegroups.createCREATE routegroups
routegroups.deleteDELETE routegroups
routegroups.listLIST routegroups
routegroups.readREAD routegroups
routegroups.updateUPDATE routegroups

Automation ​

rules ​

PermissionDescription
rules.*Wildcard access for all rules operations
rules.createCREATE rules
rules.deleteDELETE rules
rules.listLIST rules
rules.readREAD rules
rules.updateUPDATE rules

businessrules ​

PermissionDescription
businessrules.*Wildcard access for all businessrules operations
businessrules.createCREATE businessrules
businessrules.deleteDELETE businessrules
businessrules.listLIST businessrules
businessrules.readREAD businessrules
businessrules.updateUPDATE businessrules

triggers ​

PermissionDescription
triggers.*Wildcard access for all triggers operations
triggers.createCREATE triggers
triggers.deleteDELETE triggers
triggers.listLIST triggers
triggers.readREAD triggers
triggers.updateUPDATE triggers

jobs ​

PermissionDescription
jobs.*Wildcard access for all jobs operations
jobs.createCREATE jobs
jobs.deleteDELETE jobs
jobs.listLIST jobs
jobs.readREAD jobs
jobs.updateUPDATE jobs

Events ​

Events permissions are organized by event stream (table) for granular access control.

Raw events (gateway ingress) ​

PermissionDescription
events.raw.createCREATE access for Raw events
events.raw.deleteDELETE access for Raw events
events.raw.listLIST access for Raw events
events.raw.readREAD access for Raw events

Processed events (normalized) ​

PermissionDescription
events.processed.createCREATE access for Processed events
events.processed.deleteDELETE access for Processed events
events.processed.listLIST access for Processed events
events.processed.readREAD access for Processed events

JS execution logs ​

PermissionDescription
events.js_executor.createCREATE access for Js Executor events
events.js_executor.deleteDELETE access for Js Executor events
events.js_executor.listLIST access for Js Executor events
events.js_executor.readREAD access for Js Executor events

Router events ​

PermissionDescription
events.router.createCREATE access for Router events
events.router.deleteDELETE access for Router events
events.router.listLIST access for Router events
events.router.readREAD access for Router events

Business rule events ​

PermissionDescription
events.business_rule.createCREATE access for Business Rule events
events.business_rule.deleteDELETE access for Business Rule events
events.business_rule.listLIST access for Business Rule events
events.business_rule.readREAD access for Business Rule events

Trigger execution events ​

PermissionDescription
events.trigger.createCREATE access for Trigger events
events.trigger.deleteDELETE access for Trigger events
events.trigger.listLIST access for Trigger events
events.trigger.readREAD access for Trigger events

Audit events ​

PermissionDescription
events.audit.createCREATE access for Audit events
events.audit.deleteDELETE access for Audit events
events.audit.listLIST access for Audit events
events.audit.readREAD access for Audit events

Notification events ​

PermissionDescription
events.notifications.createCREATE access for Notifications events
events.notifications.deleteDELETE access for Notifications events
events.notifications.listLIST access for Notifications events
events.notifications.readREAD access for Notifications events

General (all streams) ​

PermissionDescription
events.createCREATE access for all event streams
events.deleteDELETE access for all event streams
events.listLIST access for all event streams
events.readREAD access for all event streams

Best practices ​

PracticeRecommendation
Prefer groupsUse group-based memberships for enterprise teams
Least privilegeStart with read-only and add permissions intentionally
Isolate sensitive branchesApply RolePolicy = strict where inheritance must be blocked
Audit accessRegularly review memberships, group composition, and role definitions

Next steps ​

Business Source License (BSL 1.1)

© 2026 MapexOS