core.auth

core

L1 permissions semantics for membership, role, permission, and ownership

Predicates

Predicate policies that control how graph statements are formed.

Name	Predicate	Permission	Priority	Schema.org
`member-of-predicate`	—	—	—	schema:memberOf
`has-role-predicate`	—	—	—	schema:roleName
`has-permission-predicate`	—	—	—	—
`owns-predicate`	—	—	—	schema:owns
`member-of`	`member_of`	read	65	schema:memberOf
`has-role`	`has_role`	write	80	—
`has-permission`	`has_permission`	admin	90	—
`owns`	`owns`	owner	100	schema:owns

Key	Exported as	From
`role-assignment`	template	`role-assignment`
`access-mapping`	template	`access-mapping`

Create a role assignment resource and attach a has_role statement

Key	Type	From
`root`	resource	`assignment`

Name	Type	Details
`assignment`	resource	namespace: auth.role_assignment
`principal-has-role`	statement	{principal-id} —[has_role]→ {role-id}

Apply generic access links for a subject across memberships, roles, and permissions

Key	Type	From
`root`	resource	`mapping`

Name	Type	Details
`mapping`	resource	namespace: auth.access_mapping
`memberships`	statement	{subject-id} —[member_of]→ {"$item":true}
`roles`	statement	{subject-id} —[has_role]→ {"$item":true}
`permissions`	statement	{subject-id} —[has_permission]→ {"$item":true}