> For the complete documentation index, see [llms.txt](https://codemash.gitbook.io/codemash/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://codemash.gitbook.io/codemash/cloud/concepts/permissions.md).

# Permissions

Roles and policies — who may do what in a project, and in your account.

A project has many callers: your team in Cloud, your app's signed-in users, anonymous visitors, servers and AI agents with keys. Each must be able to do exactly its job and nothing more. Norbix answers "may this caller do this?" with **roles** and **policies**.

## How Norbix models it

```
caller ──has──► roles ──have──► policies ──hold──► statements
                                                    effect: Allow | Deny
                                                    actions:   database:read, database:create, …
                                                    resources: *:*:database:collection:books
```

* A **policy** (`pol_…`) is a list of statements. A statement allows (or denies) **actions** on **resources**.
* An **action** is `module:verb`, for example `database:read`, `database:create`, `database:update`, `database:delete`, `membership:assignRoles`, `project:manage`, `marketplace:execute`.
* A **resource** is `account:project:module:kind:id`, where `*` means "any": `*:*:database:collection:books` is the `books` collection in any project, `*:*:database:schema:*` is every schema.
* A **role** (`nr_…`) is a named set of policies. Users, service users and keys get roles.
* **Default deny:** what no policy allows is refused, with a message that names the missing permission, for example `Caller is missing required permission 'database:create on acc_…:pr_…:database:collection:books'`.

### Built-in roles

Project roles (Membership → **Roles**; the **Type** column says **System**):

<figure><img src="https://712692422-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHy372bqsaex2cqS3ikhL%2Fuploads%2Fgit-blob-dc1eca0eb458db91ff679b2d7d14c79c9e483d64%2Fpermissions-1.png?alt=media" alt="Membership Roles list with the seven system roles and their policy counts"><figcaption><p>Membership → Roles of a new project.</p></figcaption></figure>

| Role                     | Can do                                                                                                                                     |
| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------ |
| **Administrator**        | Everything in the project                                                                                                                  |
| **Viewer**               | Read every module; change nothing                                                                                                          |
| **Data Editor**          | Create, change and delete database data (records, taxonomies, terms, imports, exports); not schemas, triggers, integrations or settings    |
| **Developer**            | Build schemas, triggers, integrations, code and webhook destinations, and run them; no module settings, no secrets, no role administration |
| **Authenticated**        | A signed-in end user: their own records, notifications, payments, profile and AI chats                                                     |
| **Guest**                | An anonymous caller: nothing, until you add a policy                                                                                       |
| **Admin Portal Manager** | The Admin portal's own service user                                                                                                        |

Account roles (Account → **Security**, route `/account/security`, for your team): **Account Administrator**, **Auditor**, **Billing Manager**, **Team Manager**, **Projects Developer**, **Support Manager**.

### Your own roles and policies

* Project: Membership → **Policies** → **Add New** (a custom policy), then Membership → **Roles** → **Add New** (a custom role with **Role name**, **Description** and its policies).
* Account: Account → **Security** → **Roles** / **Policies** → **Add New Role** / **Add New Policy**.

### Keys

An AI service user key gets a role from its scope: account + read = **Auditor**, account + admin = **Account Administrator**, project + read = **Viewer** of that project, project + admin = **Administrator** of that project. See [Keys and environments](/codemash/get-started/keys-and-environments.md#keys).

## Where you use it

* Cloud: [Membership → Roles](/codemash/cloud/membership/roles.md) · [Membership → Policies](/codemash/cloud/membership/policies.md) · [Users](/codemash/cloud/membership/users.md)
* AI: [Read-only keys](/codemash/ai/developers/read-only-keys.md)
* API: [Membership → Roles](/codemash/api-reference/membership/roles.md) · [Membership → Policies](/codemash/api-reference/membership/policies.md) · SDK: [Install the SDK](/codemash/sdks/install.md) · CLI: [CLI](/codemash/cli/cli.md)