---
name: step-03-roles
description: Generate role-permission mappings using MCP scaffold_role_permissions
prev_step: steps/step-02-permissions.md
next_step: steps/step-04-backend.md
---

# Step 3: Role-Permission Mapping

## MANDATORY EXECUTION RULES

- ALWAYS use MCP `scaffold_role_permissions` tool - NEVER use templates
- ALWAYS assign permissions to default roles
- NEVER leave permissions without role assignments
- YOU ARE AN ORCHESTRATOR calling MCP, not a generator

## YOUR TASK

Call the SmartStack MCP `scaffold_role_permissions` tool to generate:
1. RolePermissionConfiguration.cs HasData() entries
2. Default role assignments (PlatformAdmin, TenantAdmin, StandardUser)

---

## AVAILABLE STATE

From previous steps:

| Variable | Description |
|----------|-------------|
| `{full_path}` | Complete navigation path (navRoute) |
| `{level}` | context, application, module, or section |
| `{permission_guids}` | GUIDs for generated permissions |

---

## EXECUTION SEQUENCE

### 1. Determine Default Role Assignments

Based on navigation context, apply default role mappings:

| Context | PlatformAdmin | TenantAdmin | StandardUser |
|---------|---------------|-------------|--------------|
| `platform.*` | Full CRUD | Read only | None |
| `business.*` | Full CRUD | Full CRUD | Read only |
| `personal.*` | None | Full CRUD | Full CRUD |

### 2. Call MCP scaffold_role_permissions

```
Tool: mcp__smartstack__scaffold_role_permissions
Args:
  navRoute: "{full_path}"
  roles:
    platformAdmin: ["read", "create", "update", "delete"]  # Adjust based on context
    tenantAdmin: ["read", "create", "update"]              # Adjust based on context
    standardUser: ["read"]                                  # Adjust based on context
  includeWildcard: true
```

### 3. Parse MCP Response

The tool returns:
- RolePermissionConfiguration.cs HasData() entries
- Permission ID variable references
- Role ID variable references

### 4. Present Output to User

```markdown
## Role-Permission Mappings

### Assigned Permissions

| Role | Permissions |
|------|-------------|
| SuperAdmin | `{full_path}.*` (via wildcard) |
| PlatformAdmin | `{full_path}.read`, `.create`, `.update`, `.delete` |
| TenantAdmin | `{full_path}.read`, `.create`, `.update` |
| StandardUser | `{full_path}.read` |

### RolePermissionConfiguration.cs HasData

Add to `Infrastructure/Persistence/Configurations/RolePermissionConfiguration.cs`:

[Show HasData entries from MCP response]
```

### 5. Confirm with User (Optional)

If the default role assignments don't match the user's needs:

```yaml
questions:
  - header: "Role Access"
    question: "Adjust role permissions for {full_path}?"
    options:
      - label: "Keep defaults (Recommended)"
        description: "PlatformAdmin: CRUD, TenantAdmin: CRU, StandardUser: R"
      - label: "All roles full access"
        description: "All roles get full CRUD access"
      - label: "Custom"
        description: "I'll specify custom permissions"
    multiSelect: false
```

---

## DEFAULT ROLE GUIDS

SmartStack uses well-known GUIDs for default roles:

| Role | GUID |
|------|------|
| SuperAdmin | `11111111-1111-1111-1111-111111111111` |
| PlatformAdmin | `22222222-2222-2222-2222-222222222222` |
| TenantAdmin | `33333333-3333-3333-3333-333333333333` |
| StandardUser | `44444444-4444-4444-4444-444444444444` |

---

## MCP RESPONSE HANDLING

### Success Case

If MCP returns successfully:
- Display RolePermission HasData code
- Show role-permission summary table
- Proceed to step-04-backend.md

### Error Case

If MCP call fails:
- Display error message
- Suggest checking permission GUIDs
- Provide manual template as fallback

---

## SUCCESS METRICS

- MCP scaffold_role_permissions called successfully
- Role-permission mappings displayed
- All default roles have appropriate access
- Proceeded to step-04-backend.md

## FAILURE MODES

- MCP call failed (display error, suggest fallback)
- Permission GUIDs not available (return to step-02)
- Invalid navRoute (return to step-00)

---

## NEXT STEP

After displaying role-permission mappings, proceed to `./step-04-backend.md`
