"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const e={overview:{objective:"Manage roles and permissions to finely control access to SmartStack features according to a Context > Application > Module > Section > Action hierarchy.",problem:"Traditional systems offer overly coarse access controls (all or nothing), creating security risks or preventing users from working efficiently.",solution:"SmartStack uses a granular, composable role-based permission system with multi-tenant support and dynamic permissions for extensions."},benefits:{security:{title:"Maximum Security",description:"100% traceability and access control with granular permissions per action and per tenant"},time:{title:"Time Savings",description:"80% reduction in rights configuration time through pre-configured roles and bulk assignment"},quality:{title:"Increased Reliability",description:"90% reduction in security incidents through least privilege principle and automatic audit"}},useCases:{uc001:"View existing roles",uc001Desc:"Visualize all roles (system and custom) with their scope (global/tenant) and permissions",uc002:"Create a custom role",uc002Desc:"Define a new role with name, unique code, scope and description",uc003:"Modify a role",uc003Desc:"Update the name or description of a custom role (system roles are protected)",uc004:"Assign permissions to a role",uc004Desc:"Add or remove permissions from a role to define what it can do",uc005:"View available permissions",uc005Desc:"List all permissions on the platform (system and dynamic) organized hierarchically",uc006:"Create a dynamic permission",uc006Desc:"Register a new permission for a custom extension feature",uc007:"Delete a role",uc007Desc:"Disable a custom role that is no longer used (system roles cannot be deleted)",uc008:"Analyze effective role permissions",uc008Desc:"See the complete hierarchical tree of permissions granted by a given role"},features:{f001Title:"5-level permission hierarchy",f001Desc:"Permissions structured as: Context.Application.Module.Section.Action for granular control",f001Example:"platform.administration.users.read (Context=platform, Application=administration, Module=users, Action=read)",f002Title:"System vs Custom roles",f002Desc:"Pre-configured system roles (Admin, Manager, User) + custom roles created by clients",f002Example:"System role 'Admin' (non-editable) + custom role 'Accountant' (Finance permissions only)",f003Title:"Global vs Tenant scope",f003Desc:"A role can be global (entire platform) or tenant-scoped (limited to one tenant)",f003Example:"Global 'Admin' role applied everywhere vs 'Manager-TenantX' role limited to tenant X",f004Title:"Additive permissions",f004Desc:"A user with multiple roles obtains the union of all permissions (never restriction)",f004Example:"User with 'Viewer' + 'Editor' roles = can read AND modify (additive rights)",f005Title:"Dynamic permissions",f005Desc:"Ability to create new permissions on-the-fly for custom extensions",f005Example:"'Invoicing' extension can declare 'business.invoicing.approve' permission"},faq:{q1:"What is the difference between a role and a permission?",a1:"A permission is an atomic right (e.g., 'read tickets'). A role is a set of permissions (e.g., 'Support Agent' role = read + create + modify tickets). You assign roles to users, not permissions directly.",q2:"Can you modify system roles (Admin, Manager, User)?",a2:"No, system roles are protected and non-editable to ensure platform consistency. Create a custom role if you need a different permission combination.",q3:"How to manage permissions for a custom extension?",a3:"Extensions can declare new dynamic permissions via the API. These permissions follow the same hierarchy (e.g., 'business.invoicing.read') and can be assigned to roles like system permissions.",q4:"Can a user have multiple roles?",a4:"Yes, a user can have multiple roles (e.g., global 'Viewer' + 'Editor' on tenant X). Their effective permissions are the union of all their roles (additive system, never restrictive)."},businessRules:{br001:"Permissions follow the Context.Application.Module.Section.Action hierarchy (5 levels max)",br002:"Each role must have a unique code within its scope (global or tenant)",br003:"Permissions are additive: multiple roles = union of permissions (never restriction)",br004:"System roles (IsSystem=true) cannot be modified or deleted",br005:"A role can be global (applied everywhere) or tenant-scoped (limited to one tenant)",br006:"Extensions can create dynamic permissions via the Permissions.Create API"}},i={docsAdministrationPermissions:e};exports.default=i;exports.docsAdministrationPermissions=e;
//# sourceMappingURL=docs-administration-permissions-CXsWrgCA.cjs.map
