Skip to main content

RoleScopeCatalog

The authoritative vocabulary an admin picks from when defining a custom role. Derived server-side from authz/scopecatalog — the same vocabulary the server's anti-escalation guard validates against, so a pick can never be a scope the guard does not know (ADR-0066) — rather than hard-coded on the client, so the role editor's pickers can never drift from what the platform actually authorizes.

type RoleScopeCatalog {
  scopesByLevel: [RoleScopeLevel!]!
  tenancyLevels: [String!]!
}

Fields​

RoleScopeCatalog.scopesByLevel ● [RoleScopeLevel!]! non-null object​

Scopes grouped by the tenancy level they apply at (the concrete scopes a role's patterns may name).

RoleScopeCatalog.tenancyLevels ● [String!]! non-null scalar​

Tenancy levels a role's grantsAt may name (organization, workspace).

Returned By​

roleScopeCatalog query