> ## Documentation Index
> Fetch the complete documentation index at: https://docs.strait.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# RBAC & Policy Authorization

> Roles, inheritance, resource policies, and tag policies in Strait.

Strait supports layered authorization for user actors:

1. **Role permissions** (project roles)
2. **Role inheritance** (`parent_role_id` chains)
3. **Resource policies** (direct user grant on a specific resource)
4. **Tag policies** (grant by resource tag match)

API keys continue to use scope-based authorization.

## Core Endpoints

### Roles

* `POST /v1/roles`
* `GET /v1/roles`
* `GET /v1/roles/{roleID}`
* `PATCH /v1/roles/{roleID}`
* `DELETE /v1/roles/{roleID}`
* `POST /v1/seed-roles`

### Members

* `POST /v1/members`
* `POST /v1/members/bulk`
* `GET /v1/members`
* `DELETE /v1/members/{userID}`

### Role Lineage Introspection

* `GET /v1/roles/{roleID}?include_lineage=true`

### Resource Policies

* `POST /v1/resource-policies`
* `GET /v1/resource-policies` (cursor pagination)
* `DELETE /v1/resource-policies/{policyID}`

### Tag Policies

* `POST /v1/tag-policies`
* `GET /v1/tag-policies` (cursor pagination)
* `DELETE /v1/tag-policies/{policyID}`

## Permission Resolution Order

For user actors, `requirePermission()` resolves access in this order:

1. Role/inherited role permissions
2. Resource policy permissions for `(resource_type, resource_id, user_id)`
3. Tag policy permissions for matching resource tags

## Notes

* RBAC mutations are rate-limited with stricter control-plane limits.
* Permission cache is auto-invalidated when memberships/policies change.
* Audit events are emitted for RBAC control-plane mutations.

See also:

* [Authentication & Authorization](/guides/authentication)
* [Security](/guides/security)
* [Audit Events](/guides/audit-events)