Roles, inheritance, resource policies, and tag policies in Strait.

Strait supports layered authorization for user actors:

1. Role permissions (project roles)
2. Role inheritance (parent_role_id chains)
3. Resource policies (direct user grant on a specific resource)
4. Tag policies (grant by resource tag match)

API keys continue to use scope-based authorization.

Core Endpoints

Roles

• POST /v1/roles
• GET /v1/roles
• GET /v1/roles/{roleID}
• PATCH /v1/roles/{roleID}
• DELETE /v1/roles/{roleID}
• POST /v1/seed-roles

Members

• POST /v1/members
• POST /v1/members/bulk
• GET /v1/members
• DELETE /v1/members/{userID}

Role Lineage Introspection

• GET /v1/roles/{roleID}?include_lineage=true

Resource Policies

• POST /v1/resource-policies
• GET /v1/resource-policies (cursor pagination)
• DELETE /v1/resource-policies/{policyID}

Tag Policies

• POST /v1/tag-policies
• GET /v1/tag-policies (cursor pagination)
• DELETE /v1/tag-policies/{policyID}

Permission Resolution Order

For user actors, requirePermission() resolves access in this order:

1. Role/inherited role permissions
2. Resource policy permissions for (resource_type, resource_id, user_id)
3. Tag policy permissions for matching resource tags

Notes

• RBAC mutations are rate-limited with stricter control-plane limits.
• Permission cache is auto-invalidated when memberships/policies change.
• Audit events are emitted for RBAC control-plane mutations.

See also:

• Authentication & Authorization
• Security
• Audit Events