roleScopeCatalog

The role-definition vocabulary (valid scopes per tenancy level, entity types, tenancy levels) used to populate the role editor's pickers. Static domain metadata derived from the Go authz scope sets — no Keycloak call. Gated by the same change-user-roles permission as the roles query.

roleScopeCatalog(
  organizationId: String!
): RoleScopeCatalog!

Arguments

roleScopeCatalog.organizationId ● String! non-null scalar

Type

RoleScopeCatalog object

The authoritative vocabulary an admin picks from when defining a custom role. Derived server-side from authz/scopecatalog — the same vocabulary the server's anti-escalation guard validates against, so a pick can never be a scope the guard does not know (ADR-0066) — rather than hard-coded on the client, so the role editor's pickers can never drift from what the platform actually authorizes.