Platform

RBAC + roles

Roles are fixed bundles of capabilities, scoped to a level of the hierarchy. Pick one of the six built-in roles.

Built-in roles

Role	Default scope	What they can do
platform_owner	platform	Everything across all tenants. Reserved for Tracera staff and self-hosted operators.
tenant_admin	tenant	Manage brands, properties, users, billing, tokens within one tenant.
brand_manager	brand	Manage properties and viewers within one brand.
analyst	property	Read dashboards for the property they're attached to.
viewer	property	Read-only, no settings.
service_account	property / brand	Machine-to-machine. No password, no UI access; only API tokens.

Capabilities

The full list:

property.read       property.write        event.write
export.read         user.invite           user.remove
role.assign         billing.manage        token.create
token.revoke        whitelabel.write      domain.write

The authorize() check

Internally, every action in Tracera runs through one function:

// All authorisation flows through this one call.
fn authorize(actor: &Actor, capability: Capability, scope: Scope) -> Result<(), AuthErr>

The actor is the user or service-account; the capability is the verb; the scope is the level (and ID) at which the verb is performed. If the actor's memberships don't grant the capability at this scope or any ancestor, the call fails 403.